My guess is that this data isn't secure even at rest, as the constant flow of data breaches has shown.

They mean "no privacy protection from the website", presumably. Websites getting compromised and leaking IDs is a big deal, now that we've decided that websites should be seeing our IDs.

I think they're referring to the verification end, in terms of being required to hand over personal info to various parties, a certain percentage of which will have insufficient security and be compromised resulting in your info being leaked.

Or otherwise that if you want to effectively ban VPNs you'll end up at the point where secure encryption is effectively banned, because there are ways to tunnel traffic over pretty much any protocol eg. SSH, HTTPS if you're creative.

If you have https encryption and privacy protection, how is the VPN ban going to be enforced?