Those are problematic as well, because they're very costly. One country that implemented authentication and signing this way (I think it was Estonia?) had to recall and replace every single smart card after someone discovered a way to clone the RSA chip on them. With some bad luck, you're replacing these multiple times per year because smart card vendors often overstate the security of their products.

You could, of course, use real passwords, like every single service out there on the internet. Force some level of 2FA for security as well and you should be fine security wise.

Incremental plaintext numbers are not passwords, though. European countries have solved this problem in a variety of ways (that have been made cross-compatible and federated, even) and none of them use numbers on identification as a security number.