It isn't like a password; it's a globally unique, (mostly) immutable identifier, used across a broad range of systems.
True, but far too many businesses treat it as an "authentication" token that they can use to authenticate that you are who you say you are. I.e., they treat it like a password that only you know, and so if you can recite it to the telephone help desk person, then the help desk person is assured that the voice on the other side of the phone must be Mr. X who has SSN YYY-YY-YYYY.