I don't like it either. It's so vulnerable to theft, damage, unreliable mobile network providers, SIM fraud, government surveillance, and who knows what else.

I don't like it either. It's so vulnerable to theft, damage, unreliable mobile network providers, SIM fraud, government surveillance, and who knows what else. A security stackexchange discussion seemed rather divided over whether SMS/TOTP on mobile is "two factor" or "two step." If it's "two step," I wonder why it can't just be any two things I know. Like the good old security questions or a second email address. Should be a choice at least so we can say this much security is more than enough for me because your idea of more security doesn't actually seem more secure to me in the real world of negligent policing and unprofessional companies.