I don't really trust Authy being used as much as I think anyone else would. For the sites that I have used it with, an Authy account, or just the app is not req

I don't really trust Authy being used as much as I think anyone else would. For the sites that I have used it with, an Authy account, or just the app is not required. Therefore codes are just sent over plain SMS. Consider this scenario. Twitch now enforces the use of all accounts that want to stream all require the use of 2FA, after the whole artifact fiasco. Anyone over the age of 13 is able to do this. I don't expect everyone at this age to have a phone number, and I assume these people would rely on their parents phone to pass this. As authy is completely optional, people may choose to not require another app for their account, in effort of just quickly jumping through another hoop blocking them from going live, or the device owner not wanting to have an app installed. It just feels weird knowing that this can be a point of failure for a service that solely relies on a single 2FA method that could from an attack like this down to the individual and how they operate.