T-Mobile has a SIM lock feature that you can enable to block at least most employees from being able to swap your SIM. You can enable it in the account management app or website.

I was able to verify that it worked because an employee in a store literally could not transfer my SIM with it enabled. Their iPad app just gave an error of "customer has SIM lock enabled".

Interestingly the T-Mobile employee had never even heard of this feature, which suggests that basically no one uses it.