That assumes their password wasn't already compromised. If they re-used their Gmail password somewhere else, the attacker could have already had their Gmail pas

That assumes their password wasn't already compromised. If they re-used their Gmail password somewhere else, the attacker could have already had their Gmail password and only needed the SIM-swap to verify the login.