Isn't it because expired IDs drop out of validation databases, fundamentally?

So an expired ID is not verifiable in the same way a fake one isn't.

What validation databases and where can you get access to them?