I just went to the bother to confirm that, exactly as I expected, Google just asks me for my Security Key when I sign in. This is what their UI says they will do, and sure enough it is in fact what they actually do.

So whatever you're seeing is not in fact some sort of Google policy to prefer insecure SMS.