The credentials are stored securely on-device, and can’t be exported by the user, preventing direct sale. Device theft is still an issue, but World ID will be revocable in the future, which would invalidate the stolen identity.
On your phone? What happens if I lose my phone? How do I recover?