I was a phone store monkey working on close to minimum wage a few years back in the UK. I could absolutely swap someone's SIM with no problems what-so-ever and it typically took only a few minutes for the new one to become active and start receiving SMSes (the old one will still have signal - though no more traffic - for a few hours making detection difficult unless you actively try to place an outbound call).
While we're supposed to verify someone's identity, a dedicated fraudster could absolutely trick us and we were never given any proper identity verification solutions, nor enough training, and frankly not being paid enough to care anyway (which also exposes us to bribery/insider threats).
SMS 2FA will absolutely not be secure as long as minimum wage employees hold the keys to the kingdom, and I'm only talking about in-store employees making UK minimum wage. I'm sure the situation is much worse in offshore call centres.
The reality is, mobile phone companies never started out to be identity providers. App developers did that.
Do not hold the carriers responsible for shit we've done.
Hold the carriers and ISPs responsible for their actual crimes, like selling our data to the government and marketing companies like the world is about to end.
Every time I read post-mortems on hacks and scams in the US, my mind is a bit blown on just how easy most could have been prevented by tiny bits of government regulation that we Europeans take for granted.