It's pretty simple - there are people who don't have smart phones, plus people who couldn't manage to install/use a TOTP app. Something like ~10% of users proba

It's pretty simple - there are people who don't have smart phones, plus people who couldn't manage to install/use a TOTP app. Something like ~10% of users probably fit in that category. So either you offer them no protection (if 2FA is optional), no use of the service (if 2FA is mandatory), or ok-but-not-great protection (if you allow SMS). (In reality, some users don't even have SMS (no cell phone) - so automated voice calls can be offered too. Those without any phone at all...will not be considered as valid customers, in most cases.)