The sender is generating the link preview on Signal. Would this not eliminate the threat for the receiver? Not my field.

I worked in one of the biggest telecom companies in Europe. This is most likely an order made through customer service. The telecom companies have known about this problem for a long time. They are trying balance security and ease of use for the customer.

If company A implements noticeably stricter requirements for identification to order stuff, the average customer gets annoyed and switches to company B.

Therefore the companies watch each other closely and implement stricter requirements slowly at about the same rate as their competitors.

Protip: You can contact customer service of most telecom companies and ask them to write down a password that you need to tell them before you can order a SIM or other stuff.