2FA altogether isn't necessarily better than nothing. At its worst, it opens up a social engineering / customer support "lol lost my phone" attack vector that

2FA altogether isn't necessarily better than nothing. At its worst, it opens up a social engineering / customer support "lol lost my phone" attack vector that didn't exist before. SMS 2FA can be defeated by hijacking someone's number. Happened to me. One day I opened my Macbook and saw the "A new iPhone has been activated for your iCloud account". They had access to my number for hours after I called up my carrier.