Most ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc.
The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.
It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.
Doesnt have to be transmitted in the clear; that's exactly what TLS does; allows usernames and passwords to be transmitted with encryption so only the other party can recover them.