Push notifications are vulnerable to MFA fatigue/"bombing" attacks, that are used in the real world, cf. this breach on Uber:

https://www.darkreading.com/cyberattacks-data-breaches/uber-...