I agree it's a threat that is not exactly easy to pull off. But my main issue with is is represents an attack vector that you can do exactly nothing to defend a

I agree it's a threat that is not exactly easy to pull off. But my main issue with is is represents an attack vector that you can do exactly nothing to defend against yourself. If you use other forms of MFA, you are at least in charge. Sure you can lose your TOTP seed or something, but you have agency in how it is stored. SMS forces you to rely on companies that have log histories of failing to protect your phone number.