You are wrong, you need a valid digital certificate which can come from 1) two doses and 14 days; 2) negative PCR less than 73hrs; 3) certificate you had covid (in some cases a vaccine dose is required on top). Considering people have had Covid multiple times, a generic exemption for them might be too broad.

The biggest issue is whether businesses can use your personal information for purposes other than checking vaccination status.

Some of the European systems I've read about seem to discourage that, and the GDPR would also seem to prohibit it. But there's no willpower for such laws in the US, so we'd inevitably end up with the synergy of government and corporate power, like everything else. For instance, half the surveillance systems I listed in my other comment rely on abusing government-mandated identifiers.

The only way to be able to escape this is to be independently wealthy, which with the way our economy is designed is only ever possible for a minority of people. I agree that vaccine requirements are part of ever-creeping totalitarian control, regardless of apparent prudence, but to frame it as some sort of not-yet-here watershed moment is either uninformed or disingenuous.