And if you think "Gah, only an idiot would...", read HN threads about law sometime.
Then there was the time when I was traveling and verification SMS would not reach me because my carrier plan does not include receiving SMS internationally.
Then there was a few other times and cases where not using your phone (provided you have one and carrier plan) but a public text service instead.
To me phone based 2FA is mostly a scheme to collect users' phone numbers as there were in the past to collect email addresses. It introduces a pretty serious point of failure by relying on mobile number (no battery, no signal, no phone, changed number, prepaid card, etc.) while only being helpful in fringe cases such as when my password has been stolen.
Moreover it promotes bad security practices instead of fixing security issues, just slap some 2FA on top of whatever exists and now it is secure.
Then there is the question of how do I change my associated number when I change phone number, then what prevents a social engineering pro from changing the number too ?
I'm not sure using a publicly readable text service is so wrong, it mitigates the relying on phone point of failure, protects your privacy better, someone else reading the code may not be a problem as the code alone is useless.
As usual this really depends on what is the threat model you trying to protect from. Neither option will be able to protect you from a nation state targeted attack.
Never had that request from them, and I'm an active user of the Humble Bundle and Humble Store. What triggered that request?
At some point in the past collecting user email addresses became the standard and using disposable email addresses was the answer. More recently the trend seems to have upped to collecting phone numbers to which the answer is those public text services.
Abuse, for one -- many services use "prove you control a phone number" as a first-pass filter for "An action which is easy to do once but hard to do 100,000 times" to authorize people to do a wide variety of things.