They basically are available to any business that needs them. Just takes a few months to go through the compliance process for an identity verification company. See https://cognitohq.com/docs
Regarding it being a password, yeah that is pretty bad. Some friends of mine are working on Bloom (https://hellobloom.io/) which is trying interesting things that hook into the real world (necessary) while also trying to create a better system eventually. Basically, an ID you control with a private key is approved by identity verification services. Your friends basically vouch for the ID being correct. Your identity is tied to that ID. If you lose the private key then you have your friends invalidate the old ID and transfer their vouch to your new ID. Way better than just a secret number.