Isn't it because expired IDs drop out of validation databases, fundamentally?

So an expired ID is not verifiable in the same way a fake one isn't.

What validation databases and where can you get access to them?

I don’t really know, and I am guessing it varies from country to country anyway.