They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?

But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym?

Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.

They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc.

At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases.

However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.