Can a SIM card lock be circumvented?

  1. If so, how would one go about that, and realistically, how long would it take?
  2. Is there something we can do proactively to make this more difficult?

This seems more relevant than ever since we would not want anyone to gain access to our phone number and any associated accounts, and more and more services, even financial ones seem to force their user to rely on phone number-based identities and authentification.

Note: Assume that we have no reliable way to deactivate our SIM remotely as it is prepaid.