There is also SMS passive reading using LEO intercept. Hacked police email accounts are used to gain access to carrier systems where they use “imminent threat” no warrant lookups to pull the SMS in real time.
SMS is a terrible form of 2FA, better than none but not by much.
As someone who also has produced code that looks like random characters spewed onto a terminal while using fpdf, I feel this one.