The author seems to be assuming that, if they enable third-party app 2FA, SMS-based 2FA will be disabled; and so, they're assuming because they are still gettin

The author seems to be assuming that, if they enable third-party app 2FA, SMS-based 2FA will be disabled; and so, they're assuming because they are still getting SMS verification codes, app-based 2FA hasn't been set up. But the support documents don't actually say that enabling app-based 2FA disables SMS-based; in fact, the docs seem to view app-based 2FA as a supplement to SMS-based 2FA (to be used when you don't have a signal), rather than a replacement. I tried enabling app-based 2FA, and Twitter still sends me SMS codes, but using the code from Google Authenticator, rather than the one from the SMS, also lets me log in. So, it's not clear to me that app-based 2FA actually is broken. Still, given the security weakness of SMS, not letting people disable it in favour of an alternative form of 2FA does seem like a bad decision.