You're both right.

Without exposing my citizenship, I was able to use by EU-nation issued ID to confirm only my year of birth.

The website supported this country's national ID login method, in the login challenge asked the server to provide my age, before I signed in to confirm (scanning qr code with my mobile app) I was informed what data was requested, then I consented to them confirming my data.

Not very sensitive things work without my physical ID present, sensitive have additional step with me providing my physical ID (to the NFC reader) and unlocking my key (stored on the ID) with a pin.

All in all it's really very sensible and fast.

Not necessarily the EU ID apps we're talking about but some of the existing implementations.