As someone I know has found out to their cost esims have their disadvantages. They were sim-jacked when a scammer got hold of her email and mobile phone number details, probably from a breach somewhere. They then convinced (and it wasn't all that hard apparently) her (UK) Mobile phone network to port her phone number to their esim. Using that they took over her email using the reset password function and used the her phone number registered to her as the two factor authentication. From there it was easy to compromise many other things, and I've been helping with the aftermath. The scammer had set the email to forward to a Gmail account they'd set up and not keep copies.

The mobile network, who have admitted they screwed things up (lack of security checks) and caused all of this. I've reset everything and moved them to a new email address, The bloke in the mobile network's shop said this wouldn't have happened if it was a physical sim because they would have had to send it somewhere and then be traced. I'm being a bit careful with what I write because this is still being investigated.