I was a phone store monkey working on close to minimum wage a few years back in the UK. I could absolutely swap someone's SIM with no problems what-so-ever and it typically took only a few minutes for the new one to become active and start receiving SMSes (the old one will still have signal - though no more traffic - for a few hours making detection difficult unless you actively try to place an outbound call).

While we're supposed to verify someone's identity, a dedicated fraudster could absolutely trick us and we were never given any proper identity verification solutions, nor enough training, and frankly not being paid enough to care anyway (which also exposes us to bribery/insider threats).

SMS 2FA will absolutely not be secure as long as minimum wage employees hold the keys to the kingdom, and I'm only talking about in-store employees making UK minimum wage. I'm sure the situation is much worse in offshore call centres.