An unauthorized port is not really that difficult
It would violate the law, but you have a better than 1 in 10,000 chance of pushing a port through with very little effort
Also it could happen due to technical issues (eg I have seen in my own personal experiance Public / Koodo somehow assigning same phone number to 2 active subscribers at same time, in addition to this somehow Public has in the past assigned 2 active phone numbers on same SIM card*) so in weird scenarios who knows what can happen
Or it could simply be user error on part of Koodo rep. Things happen.
*One of my old account now long dead was a total mess; every month it seemed I had issues with unable to change plans, unable to change numbers, unable to do things in self serve etc. My post history speaks for itself. It was only afterwards a Mod (Shazia?) figured out the dual phone number thing that it started working like it was supposed to... at the time I just blamed BETA for everything lol