You are right if to speak about access control, but TSA, police, and the likes have other goals. They want to establish firmly one physical person <-> one DB id

You are right if to speak about access control, but TSA, police, and the likes have other goals. They want to establish firmly one physical person <-> one DB id relation. People checked may for various reasons try to thwart such attempts. In such circumstances it's hard to come with a solution which is not bio*