The telephone network was designed with total trust for “network operators” who essentially have “root” to do anything.

This worked OK when the only operators were the various national phone monopolies (Cap’n Crunch notwithstanding), but today that level of access is much easier to get and abuse, and is difficult to trace.

There are efforts to bolt-on security to the telephone network but it’s really hard.

I think it’s more likely that (over the next handful of decades) the phone network fades into obscurity as more voice calls are connected over data links which offer much improved security models.

It's being worked on - there's a standard called STIR/SHAKEN which uses certs to verify calls. I worked on this on my last contract. It's pretty easy to implement as a prototype - I've done it myself - but integrating it into the entire legacy phone network is another matter entirely.

Here's an article about it: https://www.howtogeek.com/402141/how-phone-companies-are-fin...

Because there's no financial incentive to fix it.

The architecture of business telecom is really flexible. Customer PBXes have wide latitude to make their own routing decisions, and numbers are shared across arbitrarily complex multi-site, multi-provider topologies.

What your neighborhood grocery store buys from the phone company is just a pool of voice circuits, probably fewer than its extensions and even its DIDs. There is no simple circuit-number mapping like in residential telecom.

Designing federated AuthN/AuthZ for this is not simple; getting it rolled out across all the participating equipment (with many owners and service lifetimes of 15+ years) is basically never gonna happen.