I guess it comes back to again not whether things are technically watertight, but how socially normalised something is. People are used to giving their ID out for significant transactions. This law says now that pretty much any random website has a good reason to ask you for ID documents. So when someone seeking to steal your identity already has two forms and is just trying to fill in that 3rd document to get over the line to where they can call up the bank to reset your password - the bar just got lowered. They no longer have to trick you into thinking it's a message from your bank or anything else significant. It can literally be "oh my cousin sent me pictures of their grand kids, let me just get my passport to upload so I can see them".