Ditching SMS 2FA normally means replacing it with some other 2FA mechanism (e.g. TOTP and/or U2F). Which is a good idea. I don't think anyone (except for some p

Ditching SMS 2FA normally means replacing it with some other 2FA mechanism (e.g. TOTP and/or U2F). Which is a good idea. I don't think anyone (except for some possible edge cases) are removing SMS 2FA leaving no 2FA options at all. Also, it all depends on threat model. Rarely, but sometimes, when user's anonymity/pseudonimity is at stake - SMS can be a security risk. I think there was at least one service that had only SMS 2FA for which I've decided to not opt in just because I didn't want to provide that service with my contact information beyond what I already gave them. Not like that was a security issue - more like a privacy/spam one in my case, but I can imagine cases where user's identity is actually a security issue.