The "best" part is password recovery — where SMS is typically the "second factor" to a completely insecure "secure question"
1. They draw from fixed unimaginative pools of often-overlapping questions, so that a breach in one company compromises you on multiple others.
2. Unlike a password, the actual secret question is often plaintext
If I had to design a replacement... The user would always be allowed to define custom questions, all questions could be assigned multiple synonymous correct answers (e.g. "Dr. Smith", "Doctor Smith"), and they all go through a one-way hash with salt.