We, the IT industry, have demonstrated repeatedly that we are not smart enough and/or not diligent enough to consistently protect this information. I think we should admit that and try the reverse approach: make knowledge of our PII worthless for committing fraud and theft. We need to fundamentally shift our methods of proving identity to something that doesn't rely on keeping a 9-digit number a secret.
It's obvious that having the SSN as a single point of failure is exceedingly stupid, but our government bureaucrats refuse to do anything about it. You can't even request a new SSN, it's practically impossible to get a new one even if your identity is stolen.
The only thing holding us back is red tape, which is the dumbest reason of all.
I don't regularly deal much with federal government agencies beyond the IRS. Which ones let you do nefarious things if you only know a person's name, address, and SSN? The IRS doesn't, because they require you to know info from what you filed last year.