I've always wondered how DAOs solved the Sybil problem, speculating that governance was no more meaningful or binding than a Twitter poll without a solution.
I see they just didn't.
The requirement for stuff to actually work most of the time seems to be somewhat imaginary.
Obviously sometimes it fails, and in some cases more spectacularly than others, such as with Theranos. But how many founders of companies with strategies that could kindly be called "Theranos adjacent" made of with lots of money? My guess is enough that knowing the real number would make all of us very sad and mad.
As far as a state level attack, it's possible. A complete solution to Sybil resistance is not simple.
The passport verification service is at https://coinpassport.net if you would like more information.
Stripe Identity seems to very explicitly not be intended to guarantee any form of uniqueness.