It turns out that public transportation is useful not just to get from A to B, but also for spotting unreleased devices. A photo of an alleged Galaxy S10 with a hole-punch display was posted on r/Samsung several hours ago, with a claimed Samsung employee joining the comments section with some more information and even an impromptu AMA.
According to /u/ActuallyWorkOnBixby, an alleged Samsung employee (who probably works on Bixby), the phone pictured is a Galaxy S10+ prototype being used by a worker on the bus to or from Samsung's Suwon campus in South Korea. This S10+ apparently has the security flip case on, though the security software that places a watermark with the employee and device ID on screen was disabled. He/she notes that the employee could get into a lot of trouble for removing the software.
Interestingly enough, /u/ActuallyWorkOnBixby then decided to hold an impromptu AMA about the S10+ that he/she also has, allowing redditors to ask any questions that they may have. The S10+ allegedly has an in-display fingerprint sensor and facial recognition, but the iris scanner may have been ditched (or it's just not in the build on the redditor's phone). It's also about the same size as the Note9, but lighter. Other notable tidbits include claims that the hole-punch on the top right isn't very noticeable, that Bixby may or may not be updated at launch, and that Samsung's OneUI "feels polished" and is "pretty darn fast."
The last answer was about eight hours ago, so it looks like the AMA may be over for now. Here's hoping that we see more leaks ahead of February 20th, when Samsung has all but confirmed the S10 will be unveiled.