If you make the mistake of not notifying the carrier immediately, which you won't think to do because everyone thinks the phone was stolen for the phone itself, you're on the hook for the charges.
Carriers know that no legitimate users use (or even know of) shortcodes, yet they have them enabled by default on all plans, exactly because they take a cut from this theft and they can turn a blind eye to it by pretending the charges are consensual.