It’s surprisingly common for SIMs in IoT devices to not be locked down. If the data usage spikes enough above the noise it’ll probably be detected & deactivated.
Here’s an example from a few years ago: https://scootertalk.org/forum/viewtopic.php?t=1370