Are there immediate actions people should be taking at this point? A lot of password reset flows work via username + SMS using "we've sent a code to your phone

Are there immediate actions people should be taking at this point? A lot of password reset flows work via username + SMS using "we've sent a code to your phone number (xxx) xxx-xx12". This database unmasks that phone number, so my assumption is this makes sms hijacking more viable, but perhaps someone more knowledgeable can weigh in. Does Facebook allow password resets like this, and can that be disabled?