It's a lot easier to compromise an enormous purchased batch of email addresses than it is to do SIM swapping attacks on that scale