The scam doesn't involve circumventing the initial identification. That's not the weak link.Seeing that if you claim to be vaccinated then you have to upload a scan of your vaccination card with your signed cruise paperwork prior the cruise -- which is then cross checked in the government databases (31 in all) before departure day -- I don't see how they are circumvented from an initial identification perspective. Within the ship I hope they are giving non-vaccinated adult passengers cruise pass cards with a particular design (maybe a skull & crossbones) that clearly demonstrates at a glance these people are unvaccinated if they try to go to theater shows or anything else they are not allowed into.
Basically unvaccinated passengers might as well sit in their cabins the entire cruise seeing the restrictions that are in place for them on RCL.
Your idea of a different pass card is a very good one. But since they are using a hole punch; I doubt they are doing that. A different pass card design would make circumvention much more difficult.