This concerned me as well when I started. So I went to IRS website and applied for an EIN #. None of my MS companies have my SS#.
Good point about the EIN. I have one and use it at every MSC possible. There are a few whose websites don't allow input of EINs, they seem to be programmed for the 000-00-0000 format.
Unfortunately, an MSC is only one of many many places where a data breach can happen.
As for doing a credit freeze, as far as I know the current set-up doesn't restrict you to 90 days.
I STRONGLY urge checking out the FTC website noted in my earlier post. Anyone who doesn't need credit and just wants to be protected should really consider doing a freeze. Best way to fend off identity theft.