How should threat models mention SIM swap risks?

Short answer

SIM-swap and subscription takeover risks matter for mobile identity. Hardware-verified security applications aim to raise the bar beyond SMS OTP, but recovery and operator processes still need hardening. Threat models should include device loss, insider misuse and flawed bypasses—without claiming systems are unhackable.