You lost me at:
Even though I had my SIM replaced in 45 minutes, that provided ample time to do damage. Since I have an iPhone XR, they used Face ID to access my accounts. Face ID works on the phone level, so they added their face to result in a positive pass of Face ID, and that unlocked my account names from my iCloud. Easy peasy. Keys to the kingdom.
Exactly, face id works at a phone level, so the "hackers" getting ahold of your number means nothing.
You can't add a face ID to your account when an existent one is still active, you must remove the previous and it will work only with your face.
So unless the sim hijacker got also an iPhone and stick it to your face or he knew your security passcode (which is stored at phone level) he couldn't have gained access to it.
Also,
No really the best way to advertise your business...just saying!