Some security is better than no security. It already took years to even get some of these backwards-thinking companies and services to adopt SMS OTP and it's simple for non-technical users to intuit. Also, believe it or not, some people
don't have smartphones, and they
will riot if you try to make them switch to any other MFA method...
Of course, I'm not saying we shouldn't push to improve things, but I don't think this is the right reaction either.