The whole system is built around phone numbers. It puts the end of the chain of trust in the hands of the corner store vendor not accepting a fake photocopy of an ID to swap SIMs. It’s ko different than when South Korea mandated ActiveX for browser security for banks.
Let’s not even get started on the whole Unique Identification Authority (UIDAI) joke. India doesn’t have Apple Pay because it’s illegal to have device-local biometrics - you must store it and verify it with the government.
UPI is also an extremely shortsighted system throwing away any semblance of privacy for the population. The whole thing doesn’t have fees partly because sharing every bit of transaction data with 7+ parties in every transaction is how it is funded.