But they are able to do exactly the same thing with physical SIMs! So what‘s the difference?

There is still a difference in that doing this to a physical SIM requires the carrier going out of their way to integrate a check with the automated SIM setup process, whereas with eSIM such activation request would seem to be an inherent step of the process.

I do agree that cell protocols in general need to be reformed to get rid of static device identifiers like IMEI. I'd go even further and say that the tamper proof aspect of SIMs should be eliminated - the application processor can store the key to auth to the network, putting the user in control rather than suffering arbitrary top-down restrictions enforced by hardware they purportedly own. Though obviously that's a pipe dream while regulators continue to work for Ma Bell.