How often does something like this happen? In that scenario there are a number of options though, one of which is just putting a banner on accounts that are impacted.
More often than you might think. The EU COVID-19 immunology status certificate scheme saw some fraudulent issuances, for example.
And "putting a banner on impacted accounts" both partially deanonymizes and effectively bans legitimate users for no fault of their own.
Travel documents are not a digital identity scheme, and using the ICAO biometric travel document scheme contrary to its explicit design goals is just asking for trouble.
And if that happens, what do you do? Deny service to that country's citizens?