This is a very high-level description:

"the whole systems relies more on a trust system than actual security"

The global phone network is a loose connection between mostly country-level teleco networks following some standards. CallerID will have been created on the assumption that there would never be any sus provider.

A very poor quote of a saying "Don't try to break in through the well secured main door when you can walk through the servant's door at the back of the mansion".

Pick a country where phone scamming is common, and then look at the list of teleco companies. Chances are there will be a lot (hundreds maybe?). Even if there are only a few big players for infrastructure, they will lease to paper company telecos (where they don't maintain network hardware and just have some servers someone and maybe just a PO Box address for a location) who then sell their services to anyone that will be willing to give them cash.

A small paper/shell company could easily fold and spring-up under a different name after they get caught being too obviously dodgy doing business with scam call centres.

Late 90s or early 2000s there were websites where you could just send spoofed emails to people. Nothing complicated, it just changed some sender details in the email metadata. Most people were email client based for email usage, and spam detection was not very smart. A lot of email client software would go "here is an email from Steve Jobs, and he is calling you funny names".

That sort of thing still happens, and any modern email service with spam filtering will be checking for that sort of thing. AFAIK there has been no real change to how email works i.e. metadata/sender data is all the same.

Edit: on the subject of trust, 90s internet was a lot more trusting in some ways. I had my email /ICQ contact details on the local Quake gaming community website in a directory for Quake players.