I'm pretty sure you just have to convince a salesperson that you "lost your phone" and get the same number reassigned to a new sim/device. It's the number that's used for SMS based auth, not the sim itself. Social engineering is often a weaker link than hacking or physical theft.

The threat here is they steal you phone number. There is strong evidence that someone can steal your phone number and is willing to sell that as a service for as little as $1,000 (if its t-mobile, other carriers cost more).

Hackers have also offered t-mobile employees as little as $300 to perform sim swaps, and I'd be willing to bet there were some takers near that price point.