So now your Facebook account is only as secure as your phone; after all, a chain is only as a strong as the weakest link.
When someone steals your phone, you can suspend your mobile service. You can also disassociate the number from Facebook.
The perpetrator 'borrows' your phone .. sends a one shot password request .. logs in to your account and deletes the message. You find your phone where you left it and are non-the-wiser.