You might also be interested in reading Worldcoin’s Orb had serious security vulnerability in operator onboarding: CertiK.