The threat vector boils down to using a phone number porting attack to gain access to Coinbase, and maybe also email. It has happened to many public owners of crypto.