But this comes down to bad security practices at the telco, doesn't it?

I don't know about other countries, but you can't even buy/activate SIM cards in Germany without "proper" identification through VideoIdent or another system where your passport is checked against. At least that's what I remember.

I'm not sure any type of "I've lost my SIM, please use this one" would work on German carriers without proper ID.

Moving numbers als requires some kind of paperwork, it's not that easy after all.

So... Is this a telco problem or a SMS problem?