SMS 2FA stops enough would-be criminals and checks the compliance box. They don't lose enough money to sophisticated thefts to do something better.