Yes, that's just another problem with using ICAO biometric travel documents for something they have decidedly never been designed for: They don't have any PIN code protection, unlike some national digital ID schemes based on similar technology.