Comment by jacquesm

Possibly, there is a lot of KYC involved in setting up an eSIM virtual provider but the party that ordered the eSIMs may not be in the know, and the attacker may have obfuscated their credentials or used high quality fakes.