Are you asking what it means or disagree with it?

If a: 2-Factor Authentication with Short Message Service (called "text" in the US).

If b: It's how Google's 2FA works by default, falls back to SMS.

Basically, getting control of (i.e. stealing) the 2nd factor in the 2FA scheme, and bypassing the 1st factor, the password (by resetting it). Plausible.

It's a thing. Google uses it, Paychex and Adp too. Just about every really big one uses it for two factor.