At one time I heeded advice not to rely on 2FA SMS because you know it's not secure, so I kept everything in a 2FA app.

Well through an unfortunate sequence of button clicks I wiped my 2FA state and had a hell of a time getting into the apps that I removed my SMS from.

In theory yes SMS is an attack vector but personally the safety and convenience of SMS is more valuable than the odds that someone impersonates me at my mobile provider.

(Also I stopped using that 2FA app and just use a keepass db stored in onedrive).