Apple said to be preparing for iPhones without SIM card slot in 2022

For example, I went to Sweden for a month, and in those days calling in the EU wasn't a thing. I bought a Swedish SIM for if I'd meet people there (and I did). 10 years later, I traveled in Thailand for a month and I wanted internet. I bought a Thai SIM got internet for like, 10 euro's? And that was that. The fact that Apple disallows me this freedom means I will have to switch once the Covid issues start to become less of a thing.

What does this mean in practice though? Some carriers already charge to reissue an eSIM.

With a physical SIM you can use the same one until you break it. An eSIM is "consumed" when it is provisioned into a phone and you need the carrier's cooperation to get a new one which gives them the option to charge or just be assholes in general.

Just looking at Thailand, I see many prepaid esim providers: https://esimdb.com/thailand

Also (I don't know anything about Thailand, just just some quick searching), it seems at least the largest provider in Thailand has essentially the same service: https://www.ais.th/esim/en/ where you can buy the eSim either online or in a shop.

Not sure what's going on in other countries, but back when I was a phone store monkey in the UK this was not the case. A SIM swap could be done immediately and the previous SIM doesn't get any notification. If I remember right we needed to check ID, but we had no way nor proper training to tell a potential fake ID, nor what counts as an acceptable ID (the UK doesn't have mandatory ID cards, so a lot of people don't have ID) - I would defer to my manager in this case but I'm pretty sure the whole process was really at their discretion and whether the whole thing "feels" legit. Making it look like we'd get a sale is an easy way to sway the odds in your favour (we'd need to access the account anyway to make the sale, so you can play along and buy a new plan, and once we pulled up the account you can mention "oh BTW I need a new SIM" and we would oblige).

Fun fact: to access someone's account in-store we had to either text them a code and enter it in the web UI (good!) or provide knowledge-based answers such as amount of last bill, some digits of the ID/driver's license number or a security question answer. There was bruteforce protection, but here's the fun part - it was presumably implemented on the frontend only because you could reload the page on the last attempt and reset the counter of attempts! There were no consequences that I know of (neither from the company nor a notification/follow-up with the customer) to locking out an account either.

At least part of the system was Java-based (it blew up occasionally displaying a full stack trace full of PII) and was available over the Internet (there was a site-to-site VPN for the store, but the URL nevertheless loaded on a standard internet connection when I tried it probably due to misconfiguration, so it's very likely all of that was exposed during the Apache Struts or Log4J vulnerabilities).

I think the reason SIM Swap fraud isn't as common in the UK is either because getting the money out is more difficult or because other scams (authorized push payment fraud, scammers pretending to be tech support or tax authorities, etc) are just more profitable.