The Galaxy Note7 introduced Samsung's iris scan technology back in 2016, and it's been on every Samsung flagship since. On the Galaxy S8, Samsung also added face unlock, but it wasn't authorized for secure actions like mobile payments. The issue on the S8 and Note8, though, was that you had to pick one unlock method or the other: insecure face unlock (meaning you had to use fingerprint for mobile payments) or secure iris unlock (which is unarguably harder to use).
The Galaxy S9 and S9+ are no different in terms of offering iris and face unlock options, but they are making a change that might encourage more people to use these features - by combining them into a single unlock method. The new "Intelligent Scan" mode allows you to register your face and irises, and will ask you to use one or the other depending on lighting conditions or the action being performed.
Iris scanning was introduced on the ill-fated Galaxy Note7
When there isn't enough light to perform a face unlock, the Galaxy S9 will switch to iris unlock mode (i.e., face unlock is the default - iris is the fallback). Additionally, if a secure unlock is required - for example, if you're making a mobile payment - it will switch to iris scan mode. As before, in any situation where iris unlock is needed, you can also just use your fingerprint. You just don't have to choose between face and iris as your visual unlock modes anymore.
Granted, Samsung's face unlock is not known for being especially secure, and while iris unlock is far more robust in that regard, among members of the team we generally agree it's often more trouble than it's worth in its current implementation. Still, this is a step in the right direction. Would an actual Face ID clone that can be used for things like mobile payments be better? Sure - after using the iPhone X, I really have no doubt of that.
But at least the Galaxy S9 still has a fingerprint scanner.