There are problems with the other alternatives that can prove to be an insurmountable barrier, specially for end-user products/services. Consider I have an app

There are problems with the other alternatives that can prove to be an insurmountable barrier, specially for end-user products/services. Consider I have an app that can stitch your photos together in a panorama, and you can sign up to store your creations in the cloud for some fee. > TOTP, FIDO, Yubikey or Nitrokey No user is going to buy a hardware token, just for this app. > Authy or Google Authenticator Users are more likely to go with this, but many would still not be willing to, or simply might not understand why. > something on-device like Passkey or Apple's stuff I don't know about this, have never used anything like this. Point is, SMS 2FA presents the lowest barrier to entry for most users, and it is genuinely better than having just a password. So for most applications that don't need to be super-secure, it is totally fine and probably the best solution.