It's usual for a funeral home to ask for this as the death certificate in each state requires it for positive identification. There are lots and lots of places identity thieves can snatch social security numbers from; thrown-out papers, online databases (illicit), etc. The funeral home was almost certainly not the only place where it could be found. It's possible, of course, but so are many other things. Most of us, despite trying to be careful, would be surprised how easy it is for others to get our personal information without another party wrongfully or knowingly disclosing it.
I'm sorry this happened and wish you the best of luck getting it sorted.