I love the excuse that they claim SMS 2FA has been "abused by bad actors" but forget that there's certainly a shitload of ways to use virtual TOTP, FIDO2, etc that just mean someone has to change the script and they'll be back in business in no time at all.