This just demonstrates a common misconception of smartcards. The private keys are non exportable. They never leave the card. They can't. Leaving the card destroys them.
The PIN may be compromised, but without physically having the card, the PIN is worthless. Likewise, without the PIN, the card is worthless. You have to have both.
Now, yeah, people could sell them...but the only people who would are the very same whose identity is already practically "worthless" (in the capitalist sense) to begin with, so the market sort of solves itself there. If a person's identity were of any value, they wouldn't need to sell it.
It can be used for authentication, but it should be thought of more as a signature (but in many ways more secure and verifiable)