It's a digitally signed QR code with your name on it. You can't fake it. Some just reuse some other QR code and hope nobody cross-checks the name with some other ID.
another case was that doctors were bribed to sign a document that person was vaccinated even if that person has not visited vaccination center. so yeah, there are attempts, but at the same time, law enforcement works its job sometimes.