The carriers basically have to do this anyway, one way or another, because people want to get their phone number back when something bad happens to their phone.

The carriers basically have to do this anyway, one way or another, because people want to get their phone number back when something bad happens to their phone. This would be true even without SMS authentication. A part of it is mandated by regulation, most countries require carriers to let their customers port their phone numbers out. When handling those port out requests, they don't necessarily have enough data to decide whether the request is legitimate or not, yet refusing such requests too often would draw the ire of regulators, which is something no carrier wants.