They stole your SIM. SMS option was now in their control.
SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.
I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.
Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.
That they may have friends who they accidentally do this for?
That they may not detect the fake ID some random person with your name and number shows them?
Etc etc. None of this requires getting your phone.
Only if the provider doesn't decide to be "helpful" and start allowing password resets via SMS on your 2FA number.