I can see more mundane reasons for SMS second factor. In some places, SMS is simply what people are accustomed to, and the idea of using an app feels like a we

I can see more mundane reasons for SMS second factor. In some places, SMS is simply what people are accustomed to, and the idea of using an app feels like a weird intrusion. Couple this with a PM saying "What if someone changes phones? SMS is more convenient and everyone already uses it anyway". Add a couple of years of SMS-factor, and it can quickly become considered good enough and no more work on MFA is required. It doesn't take nefarious motives.