There won't be any privacy lawsuits because I assume Instagram will not record or keep the selfies.
Do not think of this as Face ID. It's more like a Captcha. And what it's meant to do is to make things extremely complicated for those growing/botting many accounts.
If Instagram detects bot activity, it'll ask for this selfie because a bot won't be able to comply with this request.
That account won't be able to pass this selfie captcha test, so Instagram won't allow it to perform any more tasks.
You'll need to pick up the phone and go through the process. This will be very difficult to automate since it will randomly ask you to move your head in different directions, so you can't set it up in advance.
But it won't check if you're the real owner of the account. It won't match your selfie with any other photo.
All it will do is detect if there's a face in front of the camera and if the face moves in the instructed directions.
There's not going to be an employee seeing that, and Instagram will not record or keep the selfies.
And if you still feel it invades your privacy, then you'll have the option of not using it and forget about your account.
This won't be an issue for regular people since the vast majority of regular people won't trigger bot activity flags.
It's meant to make things way more complicated for those automating many accounts.