I don't know about the website but faceID has worked with the app for a while now (a couple of years at least). No idea what confirmation code you're talking about, or what the "what changed" thing you're clicking on is.

DL app does seem to require a re-authentication maybe once a day? It's definitely more than other apps but not even close to the "every single time I use the app" that RobOnLI mentioned.