The scans were obtained after people filled out consent forms, and included color, depth and infrared data as well as related info like the way a person grabbed a phone from a table. The Soli radar in the Pixel needs the motion data to tell it when to activate face unlock. Google also acknowledged collecting location info at first, but said the data wasn't necessary and would delete it. The rest of the data will be deleted after 18 months.
As mentioned earlier, face unlock on the Pixel 4 won't upload data to Google's servers -- it's storing it in the Titan M security chip. Apple also asked for face scans when it was developing the TrueDepth camera and Face ID, although it collected scans as part of studies and supplemented them as necessary to get a wider range of samples.
The news appears to put to rest concerns that Google was playing fast and loose with facial recognition data. Much like Apple, it's interested in creating a reliable face unlock system that holds up in real life, where facial hair, glasses, makeup and the basic process of aging can play havoc with face detection systems. If you find yourself more concerned with what's on your Pixel than getting into it, Google will have accomplished its mission.