This video, where Veritaseum hacks LinusTechTips' phone, gives a good overview of how it's possible to track cellphones or hack sms, even without asking a carrier or having physical access to the device: https://m.youtube.com/watch?v=wVyu7NB7W6Y

TLDW: cellphone networks rely on old, unsecure infrastructure