Theoretically, someone could exploit a vulnerability in the SS7 [0]. I’m not sure how common these are in the wild, but it had happened before.

[0] https://en.m.wikipedia.org/wiki/Signalling_System_No._7

Social engineering (or bribing) the carrier's customer service monkeys to do a SIM swap which will allow the attacker to receive your 2FA texts.

TFA is a good starter as to what is wrong with SMS. It's an authentication antifactor.