I was looking forward to switching to Apple's password manager (1password isn't doing it for me any more) but this cautionary tale is a good argument for not doing so. Basically a SIM swap can get around the protections Apple has put in place against taking over your icloud account.

There are some suggestions in the thread about how to make this harder...some of which are unrealistic (few will carry around a yubikey!)

The original post stated they use T-Mobile.

That being the case they could have turned on Sim protection. That should stop the Sim swap dead in its tracks.