Very interesting. But I'd imagine they aren't doing proper KYC to get an ExtraCare card, I bet it is very soft KYC. Like phone number verification or card payment which you can get anonymously, so it won't necessarily do too much to find the perpetrator. I wonder if it works through throttling and blacklisting so the loss and damage radius are reduced.
At the same time, though, the thought is "a criminal won't give out their business burner's cellphone number" to sign up for a card/unlock a case. There's still an additional level of self-selection required to be honest enough to want to acquire the loyalty card that a "dishonest" person does not want to spend time doing (they want to snatch and run).
Same reason Walmart gated the self-checkout Scan-and-Go-via-phone system behind a paid membership on Walmart+, criminal's not gonna burn fifty bucks to steal a couple times if they have to hand over anything vaguely close to PII, even if it's burner PII.