You've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address.

This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.