for it to work the government must not be able to access the public website's database that associates, say, your online activity with your government id token, and the public website must never have access to the government database where your personal information is associated with the government id token

this means the website, for example, would only know that you are the same human (or someone with access to that human's government id documents), if you sign up with a different avatar. the government only knows that you use a certain website

if that is not the case then yes this information can be abused