Clearly you can set it somehow, but is is hardwired? Or changeable? What if I buy a phone from AT&T and move to Verizon, does it still talk to AT&T or now Verizon?
It would be an interesting security hole if one could modify the destination number and have it just send to a third party.
The AT&T SIM still talks to AT&T regardless of what network you are connected to. It has the full international number for the AT&T SMSC hardcoded into it so it can correctly route the message it is sending.
Most operators have a whitelist of SMSCs that they will let you use. Some even ignore the SMSC field and always route all SMS through their SMSC so if you misconfigure your phone you will still get to send SMS (and so you can't use an external SMSC to send SMS without paying your telco...)
Interesting! Would that override still work when roaming internationally, though?
It sounds similar to some providers implementing a "catchall" APN for data connections, which however has a habit of failing when roaming in my experience.
The SMS messages originate from the SIM - the same device that tells the baseband how to connect to the cell network. So it's not possible (ordinarily) to separate proactive SMS from the intended recipient network.
However, if we designed an intentionally broken baseband that connected to two SIMs, and swapped the proactive SMS from one to be sent to the other SIM's network, it still wouldn't do much. The SMSes are sent to invalid phone numbers that only make sense to that carrier's internal routing.
Those are handled, usually, by checking the network code reported by SIM and applying a specific package (usually on separate partition) to the system when doing factory reset. The selection of the packages or course varies, and back with smaller flash sizes it was common to have let's say only T-mobile but for multiple countries.
It would be an interesting security hole if one could modify the destination number and have it just send to a third party.