"EcoLogic told the Super Express newspaper that somebody found the tracker in Sudan, removed the sim card and put it in their own phone, where they then racked up 20 hours' worth of phone calls" So they actually got a huge bill because they didn't set a SIM lock (if that's possible), and didn't block voice calls and so on. Presumably, they had a good contract for sending tiny packets of data, but not for roaming call…
Sim locking is a device-side control that ensures only a specific carrier’s sim is used in the device. They should have used a limited IoT-oriented sim with data limits. I kinda feel these folks were extraordinarily naive, but I’m coming from the perspective of a telco SME.
But probably the GPS receiver can't work with that.