So this means that the only protection from attacks like this is the law, and not a technical or operational hurdle like going through an AT&T hotline to get sim swapping going.

This is bad news because following the law isn't a top priority when trying to hack someone.