Technically, the third-party could simply make up a list of random (but valid) numbers, send them to the carrier to subscribe, and the carrier would do it. There is no technical means in place to stop this. The only thing that (in theory) stops it is the carrier noticing the high number of customer complaints and deciding not to do business with the third-party any more - a clear conflict of interest, since deciding to ignore the problem benefits the carrier financially.
What many of these services do is toe the line, by enticing a customer to give up their phone number for some completely unrelated reason, and bury somewhere in the fine print that they are signing up for a recurring charge on their phone bill. The customer has absolutely no idea that this is happening unless they read through pages of legalese. This way, the charges are technically opt-in, even though no reasonable person would describe it as such.
https://en.wikipedia.org/wiki/Cramming_(fraud)
The brain-dead simple technical solution for this is for the carrier to check with the customer before adding a charge to the bill. There is no reason not to do this.
Or maybe just get rid of for-pay SMS services altogether. In the age of smartphones they are useless.