One reason to ban 2FA SMS is because end users take on most of the cost of a compromise, but they are generally pretty poweless to prevent others from creating

One reason to ban 2FA SMS is because end users take on most of the cost of a compromise, but they are generally pretty poweless to prevent others from creating the vulnerability, particularly where the party requiring the SMS 2fa is a government or government contractor. I don't know that I'd go so far as saying that a ban is the right thing, but something is needed.