The Aadhaar project faced the same issue, and learnt this lesson over a decade (ending up with trusted hardware, on-device signing, and rooting out untrusted operators).

Unfortunately, Worldcoin plans to deploy it in untrusted environments, which sounds like the biggest "hack me for free money" sign ever.