Does the bar code act as a key to lookup a record in a central database, or does it just encode "I am 21, trust me" without any cryptographic signature?

Unless it's the former it's as good as a standard paper ID as far as forgeries go. If anything, having it machine-readable decreases security as it means the person inspecting it spends less time looking at it and just scans it in a machine.

I can almost guarantee it's not the latter.

You would lose; the barcodes are just machine-readable packaging of the information already on the licenses: name, DOB, address, etc.