The Vision Pro uses 3D avatars on calls and for streaming. These researchers used eye tracking to work out the passwords and PINs people typed with their avatars.
https://www.wired.com/story/apple-vision-pro-persona-eye-tracking-spy-typing/
https://www.wired.com/story/apple-vision-pro-persona-eye-tracking-spy-typing/