I'm not defending this smile-to-pay thing, but I don't think it's this easily exploitable. As far as I know(not sure, don't quote me on this), most decent facial recognition systems take note of the sort of "depths" of a certain face. So chances are that simply using a photo of a person won't do the job.
That would require extra cameras or infrared sensors driven by AI. My smartphone for example has an infrared laser it uses to measure dept up to a certain distance, which in this case would confirm your point.
If you however have a lower end smartphone with an ordinary camera, there isn't going to be a capability of depth measurement, which makes manipulation obviously easier.
I am still shocked by how many people use their latest smartphone models in combination with facial recognition. My smartphone has that option too, but I simply use an old fashion swipe-to-unlock feature.
I'm not even using the fingerprint scanner. I'm too paranoid to use these features.