in my experience it’s pure PR bs with no teeth in response to public pressure. Getting past the code verification is trivial in stores. Employees do not enforce verification at all or even when they do a decent fake id would easily defeat it since tmobile doesn’t bother sending a 2fa verification to your device.

Yes, I listened to a podcast that describes an attacker getting access even though the victim's account had a PIN (https://darknetdiaries.com/transcript/97/):

>MILES: [MUSIC] They were able to get ahold of T-Mobile and manipulate their way in through either doing it in person or doing it over the phone, and convince somebody to change out the SIM for them.