So how does one protect against this if freezing is useless because all that information was leaked anyway?
The only way someone can open a new bank account, credit card or loan in your name under the freeze is if they A) have the credit-bureau-specific PIN to lift the freeze, or B) the account was somehow opened without doing any kind of credit check.
Going to take the liberty of adding to this because the imprecision might cause some people to develop a poor model of how financial institutions work: you don't have a "credit account." You have a few firms which have partial views of your "credit history", sourced by reports from some firms you've previously done business with before. What a freeze does is that those firms (CRAs) who could disclose your credit history to a bank will, instead, report to the bank "That file is frozen."
How is this different from your mental model? Because credit decision is between a financial institution and a bank -- they don't have to ask anyone else's permission, including the CRA, to lend you money. They also don't have to "respect" a freeze on your file; it's purely advisory. It may deter _some_ banks from issuing you _some_ credit but it will likely not deter _all_ banks from issuing you _all_ credit products.
How does the system differentiate between someone showing up and doing something in your name vs you actually showing up and doing something negative?
[edit: spelling]
(They generally don't ask for payments till the end.)
143M accounts - lets just say 2% are rich/active enough to consider freezes. That's almost $3M over the course of say a week - for each such agency.
If enough folks write their congress critters asking for "make freeze/unfreezing free of change to everyone", maybe they will do something useful for once.