Tonight, I was able to contact Apple. After examining the logs of the demo iPhone X, they now know exactly what went down. Turns out my first theory in this story was wrong — but my first UPDATE theory above was correct: “People were handling the device for stage demo ahead of time,” says a rep, “and didn’t realize Face ID was trying to authenticate their face. After failing a number of times, because they weren’t Craig, the iPhone did what it was designed to do, which was to require his passcode.” In other words, “Face ID worked as it was designed to.”
It was probably the white glove folks who clean every demo unit to perfection after the final rehearsal. A set up mistake that resulted in a demo failure. Update: I’ve just confirmed this with an Apple engineer familiar with the situation. It’s not just spin from Apple PR.