Yes, it’s that insecure. I used to freak out friends in the late 90s doing it, but sadly it’s not changed much and is just as easy as ever.
Twilio will even let you spoof “your own number” on their network for outbound calls as mentioned in the article. Yes, they at least verify the number is “yours” before doing it, but it’s not hard to get around that limitation either assuming you have access to the other person’s phone.
Networking of all times has been grossly permissive historically and a lot of it is still today. With a lax upstream bandwidth provider, I could even pretend to have your IP address quite effectively (well, I don’t know a way to get just yours, but I do know how to get yours and the adjoining few hundred next to you).