How can I regain control of my iCloud after a hacker changed my phone number?

Several of the ones you mention are easily spoofed in a digital environment, or can be discovered using not too much effort.

Several years ago Apple decided that security questions are not sufficient security. You can still use them if you can, but you accept the responsibility for the consequences if your account should be compromised. Apple has been nagging at you to change your method each time you sign in.

Read this document if you think your Apple Account has been compromised. --> If you think your Apple Account has been compromised - Apple Support

Just a couple of points:

• NEVER enter someone else's Apple Account into your phone. That is pretty clear and simple. If that happens you will need to remove the Activation Lock by submitting the original purchase receipt from Apple or Authorized Apple Seller. There is no positive ID check when you created your Apple Account, so proof of purchase from this receipt is the only way to prove you are the original owner of the device.
• Your Apple Cash is not used if you enter someone else's Apple Account into your phone. That cannot be done remotely, so you would first have to remove your Apple Account on your device by entering your Password and when you do that your Apple Cash will also be removed.
• Security Question are a now an insecure method to protect your Apple Account because they are easily learned through Social Engineering. The more secure option is Two Factor Authentication where you set up a Trusted Phone number or use another Trusted Device to authenticate when someone signs into your account on another device. No one can use your Apple Account on another device with two factor authentication unless you have given them the verification code.
• Also, NEVER give someone your Apple Account Password.
• You have not indicated what happened to provide specific recommendations for prevention. It is either that you gave someone else your Apple Account password to give them control over your account, or you logged someone else's Apple Account into your device, giving them control over your device.

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

• You have the keys to the castle and no one is going to break in unless you give them the key. You would not give them the key to your castle no matter what reason they give you for wanting it. If you did give them the key, they are going to get in and lock the door. Now they benefit from the security provided keeping everyone else out.