The Marriott Bonvoy app requires 2-factor authentication to login before accessing a mobile key, making it reasonably secure with regard to security and fraud prevention.

For those upthread wondering if front desk staff are trained spot real/fake identification, it is at least possible they are. Decades ago I was a bartender, and we had a book with pictures of the last 10 years of drivers licenses for all 50 US states. We were trained to physically inspect IDs, to use the book if we didn't recognize the version we were holding, and to deny service if we weren't certain it was legit. Sure it's a different context, but my point is, it's entirely possible the front desk clerk at a hotel is properly trained to do their job.

For those wondering if physically handling the ID is a policy or not, my opinion is, who cares? Seriously. It's ok to allow for some common sense and critical thinking in life and in business. Not every little thing needs to be spelled out on a piece of paper for it to be ok. Asking to examine one's ID is a reasonable request from a hotel check-in agent, policy or not.