Agree with everything you say, but add to that a lot of sms 2fa exploits are sim or redirection attacks. It’s possible to get access to a phone number without access to the phone.

Here’s an old story of a friend who had a weird talk with someone who had redirected their phone:

https://williame.github.io/post/24949768311.html

Assuming the phone is not remotely exploited.