Capacity is heavily reduced in the cafe. There's also a protocol for the servers to deliver your food to an empty table near to you, which you then fetch yourself, so the servers aren't in close contact with the diners. Obviously, you order via QR code and the museum website, and everyone in the place has shown an EU COVID pass and valid ID to get in.

The cafe is also very open and airy, though it is still indoors. I guess swallowing a herring standing outside overlooking a gracht is even safer, so it's fair to say I exaggerated, but it's also easy to find a packed bar in town, and similarly a kebab shop with indoor dining where they don't give a rat's ass about your COVID certificate.