> SMS is the only way to get 2fa with a dumb phone and without a physical 2fa token.

TOTP authenticator apps exist for J2ME, which is supported by phones as old as the Nokia 3330.

Example: https://github.com/baumschubser/hotpants