That highly depends on your threat model. In some cases it is not safe to browse with a patched OS, let alone an unpatched one. You are far more aware about what you stand to lose. Don't base your threat model on what a privileged person in another country thinks you should be concerned about.
Having said that, exploitation in the wild can go undetected for ...
You are still using a session token, which if implemented correctly, is already secure
All the Face/Touch ID is doing is adding a second factor on the client-side, which prevents you from using the session token until the authentication is completed
iOS 13.1.3 includes bug fixes and improvements for your iPhone. This update:
• Addresses an issue that could prevent a device from ringing or vibrating for an incoming call
• Fixes an issue that may prevent opening a meeting invite in Mail
• Resolves an issue where data in the Health app may not display correctly after daylight savings ...