Bouncers are watched by cameras too. And if they don't allow in legitimate ticket holders (unless incapacitated, abusive, etc), they get removed from the job. The owner of the nightclub can't risk his business being sued, or fined, or losing business from event promoters who receive multiple complaints of denied entry at that specific venue.

The credit card/PIN combo sounds great until someone walks into the bank and says their wallet was stolen, or even, that you died last week and presents a forged death certificate. The point is every system has a failure point if someone is determined enough. NFTs can prove digital presence in a specific wallet, they can't actually prove who owns the wallet. No crypto asset can do that, which is why many people have gotten tricked into giving up their private key or recovery phrase.