This says that they're able to hijack the phone numbers by scanning a QR code to configure an eSIM. But doesn't the carrier need to authenticate device swaps like that in the first place? If the carriers allow SIM swaps without anything more than a line of text, then that's a major account security issue that I have to imagine has already been accounted for when this tech and the policies for it were developed. I feel like there's some very important details missing to this.

I haven't had this kind of problem but I've had Google Fi since it was project Fi around 2017. And had a yubikee on my Google account for just as long. Wonder if that's why. I do remember back in the day losing an old Verizon flip phone and buying a new one in store. They didn't properly disconnect my account from the old phone and someone was deleting messages before I could read them etc for a solid month before Verizon figured it out. But that was like 2001? Things have changed quite a lot.