“But here’s the thing: carriers’ security has always been bad, it has even been legislated into being bad, and other companies have still chosen to build mission-critical systems on top of that weak link.”
US law makes carriers port phone numbers easily, so a crook only has to talk a store clerk into moving yours. Apple, Dropbox, PayPal, Block and Google still let a text message reset an account. They picked SMS because it makes signups frictionless and competitors were doing it. The convenience goes on their growth charts and the stolen savings go on yours.