You need both the password and the phone number, so compromising the phone number via social engineering still requires the password, and thus can't be less sec

You need both the password and the phone number, so compromising the phone number via social engineering still requires the password, and thus can't be less secure than just requiring the password. That's… why it's called two factor authentication? Or are you suggesting they'd let you reset your password with just the phone number?