TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused.

SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before you can add TOTP/U2F as a secondary.

SMS 2FA is the hardest to lose or break, so forcing everyone to keep it enabled minimizes support costs for the provider.

[0] https://www.theregister.co.uk/2016/07/24/nist_says_sms_no_go...

[1] https://duo.com/decipher/reddit-breach-illustrates-dangers-o...