> Cloning someone's SIM

Yeah I don't trust SMS either, that's why I said email. You can do a lot more to protect your email account than your phone number.

It's very disconcerting to think about how many malicious apps like that must exist in the Play Store, but again, gaining access to someone's Google account is still game over if that's how you're syncing passkeys.