Knowing about this fact I wonder why so many sites still allow SMS based 2FA and, even worse, sometimes accept just SMS codes as a proof for the password reset

Knowing about this fact I wonder why so many sites still allow SMS based 2FA and, even worse, sometimes accept just SMS codes as a proof for the password reset workflow. The incentives are all wrong: Telco support people are incentivized to handle as many calls in as little time as possible and to be as helpful to customers as possible. In 99% of calls, being "difficult" about this will cause customers with legitimate issues to be angry and will cause the ticket to stay open for much longer than what's necessary, so I totally understand where they are coming from. I wish my Telco had an option where I could set a flag to never help me with account recovery at the promise of in return never getting angry at them for not helping me. Then "we can't help you" is the quickest way to solve such a ticket for them and it's also the safest for me. Honestly, if I ever lose access to my phone account, I'd rather get a new number than have some helpful person hand over the keys to umpteen accounts I have on the internet which I can't secure adequately because of braindead policies at those accounts.