A soldered SIM, or eUICC (embedded Universal Integrated Circuit Card, it's official 3GPP name) is managed by a 3rd party, with a permanent secret inside it. It

A soldered SIM, or eUICC (embedded Universal Integrated Circuit Card, it's official 3GPP name) is managed by a 3rd party, with a permanent secret inside it. It also has a resident provisioning profile, typically associated to a small cellular operator with roaming agreements the world over (small, not to be perceived as a threat by other operators). The eUICC can connect to the 3rd party using the default profile, typically using roaming. This is using the standard SIM toolkit functions, and the connection is secured using the secret. This is used to download a new operator profile, based various parameters (country of connection, user choice, device vendor contracts, ...). Then the device can reconnect using the new downloaded profile. The 3rd party manager can reach the SIM at any time, and add / delete / modify profiles as needed. So it adds a lower layer. A bit like one can add an hypervisor under an OS, here you add this new profile management layer under an operator profile inside the SIM. But it still use secure exchanged mechanism, based on a secret burned in the SIM and known only to the manager.