I think the complex question is how much liability should be taking on for this sort of thing. Theoretically the losses could be massive if a rich person gets scammed... Is the liability unlimited?
Bullshit. The cell provider is the only entity with the ability to transfer a number to a new sim, they are 100% responsible and liable for the transaction.
And since many services only offer 2FA via SMS, there is even more reason that cell providers should smarten the fuck up and put some proper verification measures in place.