And yet they still support SMS. Coinbase CHOOSE to use that security mechanism because it is quick and easy for them to onboard new business. They could, quite easily, restrict access to other mechanisms.

Instead Coinbase have decided that it is a sufficiently secure form of identification by which they will assume authorization for payment initiation.

If this users SMS was hacked, then the user didnt authorise payment, and coinbase incorrectly assumed that it was based on their own lax security requirements.

If this was regulated in the same way as a Bank, an EMI or a PISP then Coinbase would definitely be at fault here. I hope the legal system sees it in the same way and this guys assets are returned.