It's usually very easy to get a carrier to transfer a number to a new SIM without being the owner of the number. It can even be transferred to a different carrier. The standard security around this is very poor. This is one of many reasons carrier-based calls and texts should be avoided. You should make sure none of your accounts have phone-based recovery, which ideally means not providing them with a phone number in case they provide a recovery option. Similarly, avoid SMS-based 2FA. SMS-based 2FA is often worse than not having 2FA at all because it can often be downgraded to SMS 1FA via recovery through the phone number.
You can still use a SIM PIN with auto-reboot and it shouldn't impact usability much since you should mostly be using end-to-end encrypted call/messaging apps anyway.