If I said
"can I have a loan, my name is John Smith from 123 Main Street"
And the bank gave me money and stuck it on John Smith's account, people (John Smith) wouldn't stand for it.
In an ideal world SSNs would be published in a global lookup list, getting rid of the entire idea in the average person's head that SSNs are secret information when they aren't.
Could just replace that with "in other countries".
Where I live my personal number is considered public and government will give it to anyone asking. Authentication is done using one time codes, certificates, identification cards and similar. Nothing stops a company from treating the personal number as some authentication factor but it would make no sense.
(A large number of problems in the US are cultural problems, and many "solutions" from SV are solutions for uniquely american problems)
For a few services if you forget the password you get the letters again.
It's mostly used to log into government services, but you can also use it to digitally sign arbitrary PDFs.
Banks have their own system where you need an app from the bank to confirm your identity when logging into your bank account or to authorize payments.
As far as I know, identity theft is really not much of an issue here. The biggest weakness is phishing (eg. people could call and pretending to work for your bank, asking to you to confirm something on your phone app)
Fault isn't the important question. Often the damage is done to the SSN owner, with zero consequences to the person/organization who misuse and/or mishandle the data.