Does a bouncer at a nightclub really need to know I received one dose of a Pfizer vaccine against COVID-19 in Austria on February 18, 2021? Or does he need to know that 'I am fully vaccinated to enter this venue according to local laws'?
Would you trust every and all third-party applications with this 'Login with Facebook' functionality, to not look at your plaintext password? Or would you rather have Facebook not send your password in the first place?
The type of shot, and the amount of shots, even the date of the shot, are all perfectly valid requirements that can end up in local law. Astrazenica doesn't work well against the British covid variant, so in an outbreak you might end up with laws restricting the type of vaccination, easily.
To determine what is and what isn't allowed, the logic should be built into the verification code, which each government can make their own for.
If all of Europe were to use the same laws and regulations then I'd agree that this information does not need to be stored in the QR code. This is impossible to manage in practice, though.
What or who generates these QR-codes? Can't that system also provide the verification check? It is a European-wide 'system' after all.
Who do you trust more with your data: your (european) government or a (non-european) government/private entity?