It’s not that terrible compared to what’s out there and falls in the “trivial” category (which is not necessarily a negative; less complexity is good) but it’s far from ideal and it’d have to improve before pushing it globally.
As an example, some jurisdictions might declare individuals with single doses protected.
Another real example: the EU is unwilling to accept Covishield vaccinations, despite it being AstraZeneca/Vaxzevria manufactured in India.
I don't see this as any different than carrying around any other ID in my wallet. My driver's license also has my name and date of birth (plus information about my eyesight and home address).
The nice thing about the vaccination passport is that it is like a card in your wallet. There's no centralized server that's being queried. It's offline and distributed.
There has been a lot of progress both in fundamentals and implementations on this front over recent years but even decades old schemes using attestations would have been a huge improvement over “dump and read data through trusted server”.
Here’s a trivial one that anyone could implement without using anything new from the past decade: Whoever stands as “trusted party” could have signing certificates distributed to the verifier-side of the app. They sign hashes of the relevant info. All data sharing needed is once per issuance of “vaccination certificate”. No persistence of PII necessary. If you don’t want to have to disclose PII as part of validation, that’s where the fancier schemes come in.
If you can’t or won’t spend resources to do it properly then yes, physical card is preferred.