The problem is that the SMS is being used not to implement 2FA, but 1/2FA where you can get into the account with just one of the two factors, rather than requiring both.