The problem isn't with 2FA, the problem is with SMS-based 2FA.