Great point. As far as I'm aware, for the most part, they're not. Lazy bad actors can just buy a bulk set of fresh SSNs and credit card numbers off of the dark web for cheap.

Fax is still a terrible solution, overall. But it's not usually a huge risk - other than as a warning sign that one might be working with an incompetent or malicious organization.

Probably nothing bad happens with those faxes. A malicous actor would still need access to the physical analogue line or to the network to sniff the RTP packets (depending on how the fax is transmitted) on one of the two sides. In theory all providers involved could also sniff the traffic since calls/faxes are never end to end encrypted. But something could happen, and I dislike it very much that they demand their users to take this risk.