I am not positioned well to speak to it but a coworker who has spent decades in telcom said that another problem is the certificate authority that holds/control

I am not positioned well to speak to it but a coworker who has spent decades in telcom said that another problem is the certificate authority that holds/controls the certificates to provision these sims. Just the consolidation of who is involved in securing the sims. With physical sims, only your carrier has the encryption keys to be able to provision (and run e.g. a java program on the sim). With esims, that is not as tightly controlled. Coworker recommended I read about the "sim jacker" exploit, but I have not yet. If anyone is curious, I pass it along.