[gruez]

What happens when they smash their phone and now you have to do account recovery? With SMS authentication you can presumably offload that to the carrier.