[kevin_nisbet]

This only happens if SMS get's used in the password-recovery workflow. I don't think there is evidence that TD is using SMS to replace password reset.

So I really don't see how this makes security worse.