Authy is not as vulnerable as SMS to phone porting, as your TOTP secrets require a passphrase to decrypt. So even if someone ports your phone number, they'll only get your encrypted TOTP credentials.
Right. How big is the chance that somebody hacks all 3 barriers? Your password, your SMS and the TOTP passphrase?
Plus, if you do request the encrypted TOTP seeds from Authy you have a choice of 1. getting the download approved by another device already linked or 2. a 24 hour wait period during which Authy will send you an email every 6 hours.