the sim card has one important difference. It lives in a device that provides it with 24/7 battery and radio access.
That is really worrisome when you think about. A tiny computer running applications you have no idea/access. powered 24/7. Always with you. With access to battery, network, mic, etc. And the other side of the network that could monitor it's traffic for malicious actions is owned by the very people that could abuse it in the first place.
I'd be far more concerned with the hundreds of microcontrollers running proprietary code.
[network] <-> [phone] <-> [SIM card]
In theory. Not sure how well practise matches this though.
Is it? When you turn on "airplane mode" on a phone, is there a reason for the SIM to still be receiving power at that point?
Easy to test: add a SIM pin, turn on airplane mode and reboot your phone.
the sim has direct access to the radio and other modules, by design. it only needs the actual phone cpu/os for use interface.
if it wants to take the radio out of silent mode it can.
I always presumed "airplane mode" was the specific set of features required by the FAA to enable the phone to do the same thing as a phone that's off, from the perspective of potential interference with a plane's communications.
If the SIM can still enable and use the radio despite "airplane mode" being on, then "airplane mode" is not really "a mode for making your phone safe to stay on while on an airplane."
try this: enable airplane mode and then open any app that has system permission to change gps or Bluetooth or wifi settings. it will enable those radio and the ui will still show the little airplane there.
In other words, SIMs seem disproportionally secure w.r.t. credit cards.
If you have a credit/debit card with a chip, look at the arrangement of the contacts and compare to a SIM card. It's essentially the same standard (ISO 7816) at the lower layers, but with different application-layer protocols on top.
Also, as a matter of being the only device in posession of the subscriber but arguably owned by the telco, I'd definitely prefer it to be a removable piece which communicates over a standard interface. The alternative of embedding it into the handset is far worse from the perspective of lock-in and perhaps security.