Nonsense, too much paranoia.
I downloaded the official NHS app a couple of weeks ago, authenticated it via my NHS health number, DOB, passport scan, facial scan etc. I had to wait till the next day for manual verification, a secure process.
Rather disappointed at first as there was nothing related to my Covid vaccination status shown on the app, however that appeared a few days later and from last Monday the app allows me to show full details of the two vaccine doses I have received along with a frickin big QR code suitable for scanning when circumstances dictate.
Details can either be shown on the app or e-mailed to yourself as a .pdf file, suitable for a printed copy.
I can also view my prescribed medication and can order repeat prescriptions in a separate unrelated section of the app, which was its original purpose.
As a former programmer, system designer, software tester, I think they have done a good job, I feel that my data is secure. It would be illegal to report anything such as criminality or your full medical record via the app or QR code without the user being fully aware.
Obviously, I would prefer that such controls are not required, but we are where we are.