They should have added a PIN then. There was a time when the practice of adding PINs to SIMs (and phones) was common in my part of the world (in the era of candy-bar phones) to prevent this exact scenario: so that losing your phone won't result in someone else racking a large bill using your phone and/or SIM.

Perhaps their hardware and/or software doesn't support PIN unlocking the SIM, or they didn't consider the possibility. I'm sure they've learnt their lesson.