That's a bit like saying "most of the space of a smartphone's persistent storage is empty and otherwise used to store photos and videos" when talking about smartphone operating systems and their security.

There is nothing technically stop the carrier putting more memory on the SIM card.

They are ordered from the manufacturer (idemia,thales/gemalto,oberture) with speficied memory size depending on what capabilities are needed.

The big iffy is that manufacturers were compromised (by the US afaik) in 2015 and all cards from then or earlier should be considered compromised.

Few carriers encrypted their OTA-keys before then. I know that some carriers did not send encrypted keys to manufacturers still in 2018.

It’s even a microcontroller that emulates the original SIM, so it can have whatever specs they want.

What do you mean by "original SIM"? As far as I know, SIM cards have always been specified in functional terms, so vendors were always free to implement them whatever hardware and software they choose, as long as the result complies to ISO-7816 and the relevant ETSI/3GPP specifications.

Today, it's mostly Java Card implementations, meaning that the ISA and smartphone OS/runtime is abstracted away in any case.

This is true. AFAIK SIMs are based on an ISO 7816 smartcard with some additional features, and the former are definitely in that size range.