The problem is knowing when to take action. It could be months after the actual event before you find out about it. And you’re liable for everything in between.
Identity Theft is actually just fraud. And the companies that allowed the fraud should be required to shoulder the burden of addressing that matter with the actual people who committed the fraud. No part of that burden should ever be placed on you, just because someone pretended to be you and commit a fraud.
Freeze your credit. Burden shouldn’t fall on the consumer, but it’s easy and easy to lift when needed.