When Kenya deleted 350,000 Worldcoin iris scans, it exposed regulatory gaps that failed to stop a hardware data extraction operation.