Yes, I listened to a podcast that describes an attacker getting access even though the victim's account had a PIN (https://darknetdiaries.com/transcript/97/):

>MILES: [MUSIC] They were able to get ahold of T-Mobile and manipulate their way in through either doing it in person or doing it over the phone, and convince somebody to change out the SIM for them.