What do you mean? It’s no different with a plastic card, which user ID can be easily restricted from access at the source. Or a drivers license, or license plate which has been flagged in a computer system, or any other form of identification.
It’s laws that prevent that power from being abused. But in private settings like businesses and schools, there’s nothing to stop them. So I’m not sure what your point is here. This technology has been in use for decades, it’s just being moved to a more convenient and cost effective method. Nothing on the back end changes. If TPTB want to abuse their ability to grant access to individuals they could do that now.