The insecurity comes from the fact that once a call is in the network, it is mostly passed off without validation or verification. You only need to find someone willing to carry your call in to the network, and the rest takes care of itself.

To change the routing of a call other than yours would require you to access a carrier's systems and change where the call is routed to--which is substantially more difficult.

Kind of like ip routing, email routing, or even physical mail routing.

It's completely insecure because someone could call you, spoof your bank's number, and claim to be your bank.

http - ISP injects sales/billing garbage in the response. Completely insecure!

phone - I dial the number my bank gave me and no man in the middle ever answers or interrupts. But still completely insecure!

Now imagine you see me trying to enter my credentials over an http connection to AwfulBank.com. "Stop! That's completely insecure!" you say. "Sure, but so is calling a bank using the phone number they gave me."

If both cases are already completely insecure, why am I wrong?