> If you get a new phone, you cant just pop your physical sim in. You need to go through your provider to transfer

Which, at least with my provider, you cannot do while roaming. So if I break my phone while travelling, I cannot access my online banking until I get back home.

> - Super easy to get esims while traveling. e.g. in Mexico i downloaded an app while still in the airport and paid $5 with apple pay and instantly activated a 1 month esim.

This can be done with physical+esim, which my iPhone SE3 has.

Is there a distinct advantage to eSIM-only, with no physical slot, for travel?

> - You can have multiple esimss. With physical sims you are limited to the physical number of sim slots on your phone, usually 1 or at most 2. With esim there is no such restriction.

If you already have 1-eSIM capability, would it be hard to go to >1-eSIM+physical?

> esims can't be cloned (e.g. sim swapping attack)

This is incorrect. eSIMs are no different from physical SIMs once provisioned. The only difference is that instead of you having a physical smartcard, there is now a JavaCard-compatible card (embedded on the logic board or emulated by the modem) that gets provisioned remotely.

SIM swap attacks have nothing to do with your physical (or emulated) SIM, they were always about a social engineering attack onto the carrier's staff to replace the (e?)SIM associated with your account. eSIMs actually do make this easier because instead of the attacker having to show up in person at a store to pick up a physical SIM they can skip that step and do the whole process online.

> simply removed from a stolen phone like physical sims

If this is an attack vector you care about, you can enable a SIM PIN. In fact, this also works with eSIM if you really want to. But beware, doing so means once a phone reboots it will not have a data connection so things like Find My iPhone/etc won't work.

> You need to go through your provider to transfer, which requires calling them and verifying your identity.

I don't think this is true for all providers. I've never had to do this for T-Mobile for instance, it just activated without intervention.