When the ID changes on the tag, a nearby device can link the two id's together since they're in the same 'position' (i.e. id x was at y position and now id z is there, so id x = id y). However, someone who is not there wouldn't be able to link those ID's together. This gets you the privacy feature and the anti-stalking feature. (The anti-stalking feature likely wouldn't need a perfect series of matches; if you have a good chain of them, you'd have good confidence.)
I saw the headline and immediately realized I've noticed similar oddness in the Atlanta area recently. Glad to hear I'm not alone. So far I've been blaming it on weirdness from my devices roaming between mesh router nodes, but now I'm going to run the test script overnight and see if anything turns up.
They do have a very comprehensive simulation system with a large part of the work being done at Dobbins Air Force Base just outside of Atlanta. From what I understand, the team is quite small (<10).
Why not use reverse verbal passwords (i.e. have the bank give you a secret phrase)? That should eliminate a large amount of issues without the need for a call back.
Sprint's towers were built for it's CDMA network running in the 1900 MHz spectrum. However, their LTE network primarily run at the 2.5GHz spectrum which has far less range/requires a different cell tower spacing. As a result, they have coverage gaps on the LTE network. If they moved to VoLTE, they'd drop a lot of calls due to the gaps, so they've primarily kept voice on the CDMA network.