I was one of the devs that build the Vanguard login services, though I haven't worked on it in a long time and have since left. The SMS 2FA fallback was a stupid thing that some security architects wouldn't let us get around. I pushed pretty hard on that but alas didn't have the political capital nor time.