The reason is that many phones are simply seized or confiscated by the police.
But so-called IMSI catchers (mobile radio towers) are also a problem. This also applies if you use anonymous SIM cards. Targeted tracking (for example on the way home) of individual persons with IMSI catchers allows a telephone number to be assigned to a person. Regardless of whether the SIM card is anonymous or not. IMSI catchers can be found in backpacks or even on drones.
An IMSI catcher creates a fake cell to which your phone connects because the signal of the IMSI catcher is stronger than that of the surrounding real cells. If you are tracked long enough, the attackers only have to check which phone has been logged in the longest. Your IMSI (the unique ID of your SIM card) is then known to the attackers. On this basis, radio cell evaluations, telecommunications surveillance or other measures can then follow. As a rule, you have no easy way of determining whether your phone is connected to a fake cell.