They pretty much have to keep this short. Anything more permanent and you open up the risk of "alternative" databases being build by nefarious third parties.
When my vaccination pass would "leak" then my name & birthdate would be leaked and they would know someone of that name and birthdate got vaccinated but other than that, they can't impersonate me as if they presented the pass they would be asked to show the corresponding ID as well.