Especially in the absence of a universally available, universally usable alternative. The user experience of TOTP authenticator apps, paper recovery codes, and (so far) U2F tokens just isn't there yet, and the negative impact to individuals from being inadvetantly locked out by the loss of their second factor is massive.
SMS for recovery is deeply flawed, but it's 1) better than nothing and 2) better than any current alternative for the vast majority of people.
SMS for recovery is deeply flawed, but it's 1) better than nothing and 2) better than any current alternative for the vast majority of people.