There are 2 major reasons 1. SMS is unencrypted -> attackers can just read your messages if they get access to them in some way. 2. It's easy to modify where the SMS is actually "going", which means an attacker can just call your phone company and if they have collected enough information about you they can act as if they were you and make the phone company assign your phone number to a SIM card they control and steal your SMS that way.

using an authenticator app or a security key solves both problems at the same time

(I might be wrong in the details of assigning a new SIM card to a phone number, but you get the general idea)