I would agree that SMS 2-factor isn't as secure as we would like, but the OTP and app-based alternatives have their own problems. They're much harder to remotel

I would agree that SMS 2-factor isn't as secure as we would like, but the OTP and app-based alternatives have their own problems. They're much harder to remotely exploit, but the procedure for how to recover your account in case of sudden loss of your phone is a big hole. It's too common for phones to be stolen, lost, damaged, or corrupted with no warning, and then you need a recovery procedure that isn't just as vulnerable to malicious exploitation as any of the others.