Fun fact, the person who stole the sim probably worked for the carrier, or used someone who worked at the carrier that they either knew or had leverage over. You already have to verify your identity to the carrier if you want to make changes to your account, and while you might be able social-engineer your way past it, but I would be shocked if someone like Jack Dorsey didn't have a password associated with his account that is required to make changes. Saying the carrier needs to be sure before making changes is useless if the person at the carrier is circumventing it. Plus they already do it.