There’s nothing secure about phone numbers, receiving secret codes via SMS, etc
It is secure enough and it is the only reliable second factor to authorize that almost everyone possess.
It is less universal than e-mail (and potentially less-secure), and certainly less secure than TOTP. It also costs money, whereas the former two can be had for free.
Isn’t email hard to set up though? As in, Gmail silently dropping your emails even with DKIM set up properly? There’s services you can pay to have more luck, but then you’re at the same downside as texting
Yes, it absolutely is (though I do still run my own). I do know that it's easier than setting up a phone provider, however, which is more equivalent to setting up one's own ISP.
A phone isn't being used alone though. It's just one part of a 2FA system, right?