Note that, in this case, the SMS code is not a second factor. It is a single factor that is enough to get full control of the account. Besides that, I think yo

Note that, in this case, the SMS code is not a second factor. It is a single factor that is enough to get full control of the account. Besides that, I think you are right. Binding 'signatures' to what you are authorizing is one of the ways to prevent your authorization from being re-used. There are parallels in cryptography where you sign not just data but also what it will be used for. Otherwise an attacker might reuse your signature.