The ID number can also be used by attendees calling in via phone, so it has to be short and numeric (back to the UX vs. security tension).

Another issue was that until recently the ID number was prominently displayed in the application window. Many people (including Boris Johnson) shared screenshots on social media with the ID included.