In modern English, the plural "they" is used as a pronoun in situation when we are not sure whether some previously discussed person is male or female. For instance "the average person thinks that { they are | he or she is } more intelligent than most others".
Like any pronoun, "they" needs an antecedent.
We cannot just us "they" out of the blue; we need to speak about some person first. For instance:
A: Someone is at the door!
B: What do they want? ["they" refers to "someone".]
Here B could also ask, "What does he or she want?".
B cannot say these things if A simply went to answer the door without saying a word.
Compare:
A: Hello? B, it's for you!
B: Who {* are they | is it | is calling}?
Versus:
A: Hey B, the caller is asking for you!
B: Who {is it | ?are they | ?is he or she}?
In the second example, B can use "they" because the pronoun has an antecedent in the previous discussion: the noun "caller".
"Who is it?" is most natural; "Who are they?" less so; and "Who is he or she?" is quite unnatural.
The reason is probably that "they" and "he or she" are restricted from use in WH- clauses which inquire about the identity of the subject. Consider:
A: Someone is at the door.
B: Who is it, and what do they want?
Here B speaks a sentence made out of two WH- clauses. The first clause asks about the identity of "someone" (who is that someone), and so the pronoun "it" is used to refer to that someone, rather than "he or she" or "they".
The second WH- clause asks about something else: what that "someone" wants. In this case, "someone" can be referred to as "they" or "he or she".
If the sex of the person is known, then this is not an issue. The correct gender of pronoun is consistently used:
A: Some man is at the door.
B: Who is he and what does he want?
B: *Who is it and what do they want?
Important note: A WH-clause asking a "who" question can be rhetorical. Contrast these:
A: Someone just called, asking questions like what is our household income.
B: Who {are they | *is it} to be asking that? It's none of anyone's goddamned business!
"Who are they to ask that?" is not a genuine identity inquiry but actually a remark that the person has no authority to ask such a question, regardless of who he or she is.