[1] says the decryption key is derived from those pieces of information, and the key derivation logic is public info, e.g. [2] is an implementation.
It's somewhat clever, if someone takes a photo of the first page, they already have your personal info, to steal it from the chip they still need to have visual on the info on that page.
[1] https://randomoracle.wordpress.com/2012/08/27/reading-the-us...
[2] https://github.com/AndyQ/NFCPassportReader/blob/main/Example...
Strangely, to decrypt the data off the passport you need the passport number, the date of birth, and the expiry date. I assume this is why that playstore app needs to get a photo of your passport. Sure enough, my phone could read off other details about me including my photo after a few seconds of reading.
Never knew how it worked before, and assumed it was like how mifare DESfire cards work since the bytes I got from a simple reader app were different every time. (I assume that's done so you can't wirelessly ID people using their passports)