That would indeed be catastrophic, but from the attack as demonstrated, I don't think we can conclude that that's possible.

As I understand it, the attack as demonstrated is extracting the eUICC provisioning private key from the context of a SAT applet, but what you're describing would be extracting the keys of eSIM profile A from the context of eSIM profile B of an unrelated carrier.

It would be great to know whether the researchers have looked into that, as it sounds like a much bigger problem if possible.