This doesn't have to be the case. https://www.w3.org/TR/digital-credentials/ seems a sensible system where you can have a single identity provider (hopefully someone you trust) who can then verify things like "is this person over 18?" without givin away any excessive information to a third party. Hopefully it gains some traction.