The security of these is actually somewhat DUE TO the low adoption rates. If all of my consumer services have SMS 2FA, attackers will currently just move on to

The security of these is actually somewhat DUE TO the low adoption rates. If all of my consumer services have SMS 2FA, attackers will currently just move on to the next account in their list. It's similar to the spam game: it doesn't have to be perfect, just enough to make it not economically viable to spend the time required to crack it. Once everyone has SMS 2FA, I'll move on to push or U2F and be ahead for another decade or so. It's just important that people are given an option, so lazy / don't know any better consumers can do the easy thing and get their accounts stolen, while people who actually care / know enough to know they should care can stay somewhat safer. The unbalance is unfortunate, but until we figure out a way to ACTUALLY secure things which companies will get onboard with (related: the US uses chip cards now...but still only requires a signature facepalm) staying one or two steps ahead of the general population makes you pretty safe against everything except targeted attacks.