Far too many of the critical services (banks) still only offer SMS 2FA.