Great point about SMS 2FA. I've begun to go through any service that uses that and change it.

I had stopped using it for new 2FA configs a few years ago once it became more obvious that it's not secure, but I figured I'd be fine for my old accounts and the odds of anything happening would be very low. Lesson learned I guess.