The problem with this is simple: IDs are meant as visual verification. By making an app to do this, you are now by definition allowing my machine to create my identity. Therefore, it stands to reason that you will need a visual way to verify that the machine created the right identity which in my opinion is a bad problem to have. Therefore, people suggest using a machine to verify the id, but that defeats the purpose of having visual identification.

A simple hack utilizing this vulnerability that would be hard to fix is getting someones phone and then replacing their image with yours (e.g. by running the real program in the background and an overlay to cover their image and replace it with yours, you could get fancier and find the distortions in the image below and apply them to yours as well). In any case, the key here is that a human looks at the image, not a machine.