Not via breaking the ZKP, but via other methods of fingerprinting, which governments are very well positioned to enable.

I feel like it becomes bad faith at some point. With a sufficiently advanced attack, you can be personally identified today. ZKP for age verification does not make this worse, does it?

It's a bit like saying "no but Signal is not really encrypted, because the government can extract some metadata by looking at the network around the server".