Whats wrong with verifying the ID?

The issue is they decided to roll their own extremely questionable service and insecurely store sensitive images in a public bucket

Multiple SAAS vendors provide ID verification for ~$2/each. They should have eaten that fee when it was small and then found a way pass it onto the users later