Couldn't they trace the thief through the eSIM?

Why are theee no legal repurcussions to this?

Possibly, there is a lot of KYC involved in setting up an eSIM virtual provider but the party that ordered the eSIMs may not be in the know, and the attacker may have obfuscated their credentials or used high quality fakes.