Then they can reset your password with just your phone number — one factor. But 2FA via SMS is ubiquitous because of its ease of use.