“Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him.”
No SIM swap and no phone company insider. A marketing tool rerouted his texts after the hacker promised he had permission. The phone kept working, so the victim never noticed. Every bank that still sends login codes by SMS is trusting that promise.