A reasonable solution would be to disable the ability to add SMS 2FA to accounts and require either disabling 2FA or selecting a different 2FA method upon next

A reasonable solution would be to disable the ability to add SMS 2FA to accounts and require either disabling 2FA or selecting a different 2FA method upon next login. If specific accounts with SMS 2FA manage to abuse it after that then ban those accounts, since you can't add SMS 2FA to a new account that removes their avenue for abuse.