The problem is that mobile providers, unlike tech companies, prioritize customer service over security. Thus they have human customer service agents instead of heartless robots, and the human agents will, with the tiniest bit of social engineering, allow your phone number to be taken over or ported by a scammer.
sms can also be intercepted by folks who knows what they doing in the approximate location as the cell phone user. Cell phone/sms is NOT secure.
It is susceptible to sim swapping (probably not hte case here). I think there is also a method for mirroring the 2FA code, as well as intercepting the message (i don't know how easy it is though).
Sim swap attacks are the main way, becoming more common every day