The very website we use can be and probably is gamed by Sybil attacks. The problem is even greater on sites like Facebook and Twitter. There are regular news of them shutting down thousands of bot accounts.
I am very skeptical of Worldcoin myself but you shouldn't simply dismiss the idea.
As for minting an NFT based on your passport: Sure, that's absolutely possible. Sounds like a better idea than what worldcoin is doing. The hashing would also be a lot simply since all you'd have to do is check the validity of the passport and base the hash on the passport number which is unique. My guess is there are legal reasons to them not taking this more sensible approach.
There are many other projects working on solving the problem. Check out Idena for a non-creepy idea, but that too comes with its own drawbacks imo.