> If I can move my eSIM to a new phone, so can an attacker.

No, they can't - there is (at least for modern SIM cards and eSIM modules, see [1]) no way short of decapping the chip to extract the secret keys once they are on the chip, and even de-capping is something that the chip industry has gotten pretty good on defending against.

An attacker would have to request a new eSIM profile (aka, new keys) from your provider to hijack your number, which is an entirely different threat model.

[1]: https://www.kaspersky.com/blog/sim-card-history-clone-wars/1...