Scenarios like that are possible, but not without consequences. Your list continues like this:
- A victim reports this to the police.
- The perpetrator loses license to operate as a franchise due to this abuse.
- T-Mobile hands over the identity to the police.
- Criminal charges are easy to bring as the evidence is overwhelming.
A more typical SIM swap scam is to abuse operator's procedure to get a new SIM card to replace a broken or lost card. As the perpetrator impersonates the victim he leaves much less traces back to himself.
Also, SIM card alone isn't enough to bypass MFA. If that was sufficient, it would have been 1FA. Instead, the perpetrator must also get to victim's password in a 2FA or gain access to all other factors of a wider MFA.
Some services may allow resetting the password having access only to the phone number; now that's really a vulnerability! Also, a fallback to SMS authentication on e.g. Time-based One-time Password (TOTP) failure is not a good idea.