I suspect that the employees aren't merely doing a sim swap attack with their work login credentials. Like you say, they'd clearly get fired/prosecuted for that.
Instead, I suspect criminal X buys a nice thing delivered to employee Y's house. Then, criminal X phones the helpdesk repeatedly till they get connected to employee Y during working hours. Then, they claim to own the phone number of victim Z, but have lost the phone, their id and everything else. But they manage to tell employee Y the answer to two of the secret questions "What is your gender", and "Did you use the internet in the last month?". The employee uses this, together with their judgement to proceed, according to company policy, and issue a new eSIM.
Later, when anyone finds out, the call is listened to, and the employee can legitimately say they were just following policy.
Want to cancel 20 numbers that still got 2 years until the contracts expire? Sure, let me do that for you. Want to change sim? Sure, just give me the new sim number. Want to add 5 tariffs to your plan? Sure, do you want phones with that?
That was 6 years ago but I still got friends I talk to there, and not much has changed.
When it was finished I showed it to a few colleagues, one of which told the professor. I showed it to him and he got me a interview with a friend of his who was looking for an employee. We went for a coffee and he offered me the job right away which i took. A few weeks later i quit college, and I'm still mostly working for the company that gave me that first job, but I have my own company now.