Are FaceID/passcode logins secure over public WiFi/hotspots?

To know whether each individual app is secure in that scenario cannot be answered without thoroughly auditing each app. But assuming they are securely using TLS for all communications, any type of local biometric authentication probably doesn't have anything to do with what traffic is sent to the server.

The application is probably already logged in to the server, possibly already sending data and synchronizing your accounts in the background, and only requests biometric authentication from the OS to check if an authorized user is holding the device. So in that light, if the app does not properly implement TLS and is already communicating with your account credentials in the background, it is already inherently insecure; whether or not you use biometrics don't contribute either way in that case.