Anytime there's a merging of huge databases, many cases cannot be linked by identifiers. As the article notes, all the cases not cleanly identified as fully vaccinated were not thrown out of the analysis, but added into the "unvaccinated" category.

All participating jurisdictions had established processes for linking case surveillance and vaccination data from state/local immunization registries; this method usually assumes that cases among persons not matched to the registry are among unvaccinated persons. >

Typical ploy of CDC in dealing with missing data.