Isn't the SMS just 1 factor, and for 2FA they will also need the other F (e.g. password)?

Relying on only SMS sounds like 1FA?