This would only work if they weren't doing lookups on user/profile IDs (through scanning QR codes or some other method) -- which they almost certainly are.

If the app is really shitty and insecure, you might be able to get away with an exploit for a little while, but it would be very temporary before they patch it. Tying a user with identifiable information (whether a picture or just height/weight/etc to make sure someone isn't being impersonated) would put an end to any hope of faking the vax app, which as far as I know, they already do.