iCloud security code can come over SMS if your account is configured as such, therefore the above example of a SIM port applies
I'm not 100% sure about this, since it's been a while since I've added a device to my iCloud account, but IIRC the prompt is not the standard 2FA one: it basically asks you to approve the addition from another device, or forces you to use your security code.
No, the iCloud second factor can come over SMS. That's not the same thing as your iCloud password.