Not quite true - smartphone market penetration is quite large, so it is possible to reliably offer a universal app (see: MS Authenticator, Google Authenticator,

Not quite true - smartphone market penetration is quite large, so it is possible to reliably offer a universal app (see: MS Authenticator, Google Authenticator, Authy) for code auth. Now, sure, you can argue that SMS should be kept as an _option_ but it should never be the only one.