They also host a server allowing trusted third parties to verify that a given passport is still valid (ie. Not withdrawn).
The combination of those mean you will never edit details on a passport, but you might be able to copy a passport 1:1, because the security is only mifare classic.
You can actually read the photo from your passport with an Android phone. Some of the info in the machine readable area is required as a salt, so you can't do a remote scan of a closed passport.
I've used this app in the past; https://f-droid.org/packages/com.tananaev.passportreader/
I think anyone needing "fake passports" usually gets them from stolen identities (or stealing a passport from someone similar looking) and getting a new one issued. Probably easier in countries that don't require the passport to be sent back for another one to be issued.