assuming it was scalable, would it be OK then?

The problem with automated facial recognition technology is that it makes what used to be infeasible suddenly routine and cheap. In the past, would the security folks at Madison Square Garden have even thought about implementing this kind of policy? No, of course not; it would have been obvious from the very beginning that such a policy would have required far too many resources to feasibly implement. At best, they'd have been able to hand out pictures of a few folks, known to be bad actors, and told their security personnel, "Hey, watch out for these people and don't let them in." It's highly unlikely that a random obscure attorney working at the same firm, but not specifically tied to the litigation at hand, would have made it onto that list.

However, today, with facial recognition, it's possible for Madison Square Garden to have blacklists consisting of thousands, or even tens of thousands of people and check against them just as quickly and as easily as if they were a list of a dozen people. That's a qualitative change, and I think it's valid to treat it as a separate kind of thing than a bunch of security guards, each with a stack of photographs.