Why is it insane? You can't do much with the just the CPF number in Brazil, it is not the same as SSN, a CPF is solely for identification.
As I understand it's actually pretty similar to an SSN, i.e it's used for financial and government identification. When it gets used for both trivial and non-trivial things it becomes a huge vector for identity fraud.
My name, birthdate, address and contact info are all widely available online so keeping those government IDs secret is what backstops identity fraud.
What’s backwards is an SSN being treated as a secure token. It’s nothing of the sort.