They still need your password. The SMS alone is insufficient. Supporting SMS as a second factor (whether primary or backup) is perfectly adequate for almost everyone’s threat model, and generally far superior to not supporting it as regards avoiding account lockout. (That’s Fastmail’s position, which I thoroughly agree with.)

It's not useless. It forces the attacker to expand all the effort to get a SIM for your number. While certainly possible, it's not that easy.

But they need your password first. So you’re not in a worse position than if you didn’t have 2FA. Parent was implying 2FA made it worse.