Maybe you’re one of the first victims of Ivanti hack? The exploit can obtain names/phone numbers
https://news.ycombinator.com/item?id=36913774
>Are there any steps/recommendations I should take to bolster my security now
Of course, never use SMS as a 2FA, it’s broken by design, GSM protocol isn’t secure. And if the service insists to use a phone number, time to stop that service if you value your privacy and data.
As how it happened if it wasn’t related to the above hack, maybe your phone is compromised, but I highly doubt someone is zero-daying your iPhone just to access your Facebook account.