While the article admits that this isn't very secure, I think giving any visitor a one in three chance to "authenticate" with any given mobile number is well be

While the article admits that this isn't very secure, I think giving any visitor a one in three chance to "authenticate" with any given mobile number is well beyond "not very secure" and into "false sense of security/no security at all" territory. The introduction indicates that this is intended to be on par with confirmation emails or six digit SMS pins, but both of those actually prove that you own the indicated resource; asking someone which of three emojis they received does not.