I reported an SSPR Abuse vulnerability to a large SaaS provider, (a service that offers no real TOTP options at all) and their prompt response seemed to both mi

I reported an SSPR Abuse vulnerability to a large SaaS provider, (a service that offers no real TOTP options at all) and their prompt response seemed to both misunderstand my report as well as insisting that "SIM swaps are non-trivial" and therefore, not really part of their threat model.