I haven't travelled ID90 or dispatched a flight or whatever for years so stop me where I go wrong.
Other than the operating crew and supernumary crew listed on the GD or whatever that's now called, everyone on board has a ticket and checks in the usual way, via security etc, and that includes staff of the operating company and other companies on free or reduced rate travel.
No ticket = no contract = no insurance = no liability limits, quite apart from security aspects.
If a person "without ID" managed to get in the crew bus and then on board, why was this additional passenger not noticed and identified in the head count, or even not spotted by the crew in the bus? If the head count was right, and thus if every passenger was properly ticketed, checked in and screened by security, why did anyone take any notice of the FA's report, apart from checking back to the departure station that the counts were correct?
What's the real story?