I'm not disagreeing with you that I wish this information weren't public, but the fact of the matter is that it is public, and breaches are possible even if you have no relationship with company that was breached (see Equifax).

So all I'm advocating is that we accept the reality of the situation and start requiring more stringent forms of identification.