That doesn't seem like a smart design. It seems less secure than an old fashioned metal key.

Not for a key, no. But it's a great design when what you want is low cost ID tags which don't require their own power source and which essentially work like barcodes that you can scan without line of sight.

These chips aren't supposed to be used for secure applications (though no doubt some people do use them that way). They are intended to be used more like a UPC code.

I thought that's how keycards generally work?

Some work that way, others do PKI-ish things and so are more secure.