An attacker can call support, give them plausibly correct information gleaned from public sources, and nicely claim to have forgotten the answers to your recovery questions ("Oh, it might have been a jumble of letters and numbers... silly me..."). There are enough incorrectly trained support people who will let this through to make the tactic effective on average.
Your point is obviously correct, but everything is so hopelessly broken that it almost doesn't matter in practice.
Does it need to be? Seems most of it could be avoided if the cellular service required a visit at the store with an ID card to clone a SIM card.
Since USA has this "root of trust" problem, it's also unreasonably easy to obtain fake USA IDs since you (again) can impersonate people simply with "something you know" even for the purposes of obtaining legitimate IDs. It's not so easy elsewhere (e.g. if you claim you're me and have lost all ID, they'd just check biometrics before reissuing ID). Proper checks of IDs (+ verification of lost&stolen IDs databases) can ensure that identity theft cases are very rare. The identity theft epidemic isn't general worldwide, it's mostly a regional issue specific to USA and some similar countries.
Financial institutions offer it to sometimes - my credit union requires the account password, or a visit to a branch to show ID - no amount of personal info will allow you access.
Otherwise, what would happen in the frequent case where users forget their pin?
If by "other information" you mean "come into a store and show a government issued photo ID" you are correct. That's a fairly high bar to clear.
That's the way my carrier does it, and I assume if they violate their own procedures I could evaluate my legal options... though as a practical matter I use a VOIP # which requires a 2FA protected login to port out for vendors that force me to use SMS 2FA.
(Because no one would lie about that)
However I believe their "OneTouch" system (e.g. Twitch & Namecheap) is linked to phone numbers only, so that could be breached via SMS.
I'd recommend using a standalone 2FA app which can be backed up to your own cloud storage. (e.g. Google Drive/Dropbox)
You can set up Google Authenticator (or Authy) and a Yubikey as 2FA sources, then remove your phone number.
Much to my surprise, I was able to do this with PayPal where I set up two Symantec VIP Access IDs and was able to remove the phone number.
I wish I could do this with other accounts.
U2F is the current state of the art for 2FA. App/Device-based 2fa (krypton, Google App’s “approve on other device”, authy’s “approve on other device”, keybase, et c) are second.
TOTP is in a lot of ways more trouble than it is worth.
Once they have your number ported getting it back will take, at least, a few days; during which, they'll have unfettered access to anything that uses your mobile number to authenticate.
Use a dedicated 2FA application on a device you physically control and _write down_ the backup keys somewhere physically safe.