I've been saying a version of this for years.

Zero Knowledge Proofs are, yes, only half of what's needed. Much like pulling my ID from my wallet, I need to actively consent to offering the service the data I confirm. Preferably (IMO) every time it's requested.

Otherwise what's to stop verification abuse from literally turning into session hijacking? Someone sends me a phishing link and if I have ID auto-submit turned on, an attacker can in a second run my full name and ID contents as attributed to anything.