I have never been under the impression that 2fa with telephone numbers was anything other than surveillance. Either by the company touting it as a security enhancement or by mitm.

And for the record don't think that apps that use the central messaging frameworks enforced by Google and Apple are doing anything different. Every time I log in to my bank with Firefox or and device anywhere in the world, Google is told about it. In the real world this means that Google has to autorize my access to my bank.