Easier than what? Not having any 2FA at all? I don't really understand how it can be easier to break into a system if you need the username, the password and a

Easier than what? Not having any 2FA at all? I don't really understand how it can be easier to break into a system if you need the username, the password and an SMS code, than if you just need an username and a password. Obviously, SMS two-factor authentication is flawed. But one-time codes and WebAuthn are pretty good two-factor authentication methods to secure important credentials.