Although Apple does not allow the application developers to sell this data or use it for advertising purposes. But according to researcher Dan Tentler, once it's out of the pocket of Apple, it's no longer important what the rules are.
See also: How does Face ID of Apple work?
'Not important. The advertiser is also looking for these data, which may have an underground market or a black market to exchange, no matter what Apple stipulates, 'Tentler said. 'The problem is that Apple only security with a bunch of rules'. He added: 'If everyone follows the rules, we will never see malicious code or kill people. Can't rely on that to prevent others from doing bad things. So if Apple doesn't offer a more secure way, it could be very bad. '
This does not mean that iPhone X users will be at risk of security, but they need to be more cautious. Apple does not really secure security, but using TrueDepth also requires user permission.
In other words, every time an app asks you to access the data of TrueDepth Camera, think a little bit before agreeing.