They were probably telling the truth. It’s pretty common to have to register hotel/hostel stays with the authorities, and it’s increasingly uncommon to own a flatbed scanner - so what did you expect them to do, pull out a DSLR?
I'd expect them to get the right equipment for them to operate their business instead of having people use their private cell phones to save my photo id to their personal iCloud account and God knows where else.
It's like you're arguing banks should be absolved of using tls because it's just so tricky.
If your business requires you to handle PII I expect you to have the right equipment and processes to handle it.
I stayed with a friend in a Balkan country a couple years back and she had to take my passport and that of a couple of relatives down to the police station.
