I have a bigger concern with myGovID. It pushes a notification, with "accept" or "decline". What happens if you accidentally hit "accept" when it wasn't you that logged in? There is no way to end a session/revoke a token from the app.