Agreed. Although poor security with easy hijacking, it's still a form of 2FA. Even NIST doesn't recommend it as a factor to use for authentication.