This is not completely true.

With ZKP, if you make a business out of reselling tokens you get with your own identity, eventually they will see that you use orders of magnitude more tokens than normal people.

So with ZKP it's more difficult to cheat. Not impossible, just less accessible.