Security is a complex exercise, and there could not be any rush in protecting sensitive data. Aside of fact that vaccine passports are infringement on people freedom, governments should have asked themselves is this information that can be handled by startup. Unfortunately we see an opposite, governments around the world buying those type of apps from startups who are in gold rush mode to deliver, because window of opportunity to get their hands on budget money is short.
https://blog.malwarebytes.com/privacy-2/2021/09/vaccine-passport-app-leaks-users-personal-data/