SMS should only ever be used as a proof of investment. IE making sure a bit setting up hundreds of thousands of accounts (because they broke your CAPCHA) needs to buy tens of thousands of real phone numbers with service.

It’s a one time thing at account creation and should be immediately deleted afterwards.

Real 2FA should be set up afterwards to actually protect the account. A yubikey or even a simple TOTP app is a lot of protection against account takeover. The only big weakness left at that point is the help desk.