Apple 2FA only use SMS if there isn't a more secure method available and it must be explicitly selected when enabling 2FA. From 2016, the default is trusted App

Apple 2FA only use SMS if there isn't a more secure method available and it must be explicitly selected when enabling 2FA. From 2016, the default is trusted Apple devices (running a minimum of iOS 9 or MacOS 10.11) or web browsers that are registered to your Apple ID. It can fallback to an automated phone call with two trusted phone numbers.