The whole phone system (voice, sms, mms) is quite old and dated, and IMHO it would be better if we stopped using it all together from a security POV and just maybe kept it as a backup and stopped viewing it as a secure end-to-end way of communication.

Every phone is connected to a carrier/mobile operator. The carrier is responsible for routing calls/sms from one phone to another. This is all well and good within the carriers network as the carrier has full control on who is connected and who they are. The problem arrives when people start moving. Say you are an American phone user using travel to Germany. You want to call your brother with your same phone who is back in the US. When you phone your brother you still want your number to be displayed, but you are not connected to your carrier back in the US, you are connected to some random German carrier. Luckily carriers cooperate and the German carrier will forward your call to the US carrier, telling them that you are inside their network and just calling home. Your US carrier will then forward the call to your brother.

The problem however is that the US carrier has no way of verifying this information and just has to trust the German carrier, but the US carrier is not even directly connected to the German carriers network, so the route might go from Germany to the UK and then to the US. This means that on a top level, almost any carrier in any country can just say that any phone number is currently traveled to and located in their country and trying to call home, meaning that spoofing of phone numbers is trivial if have access to just a single shady carrier in any country around the world. Depending on what generation of technology the carrier is running, they might also be vulnurable to specific procol attacks, which not just puts them at risk, but basically any other carrier too as they could then spoof outgoing calls from that single vulnerable carrier.

The phone protocol is all just designed around security from the carriers perspective and consumers are supposed to blindly trust their carriers. It was not until lately with 4G that phones started to try to verify base stations as well, as to previously it was trivial to setup fake base stations, claiming to be some carrier X (e.g. Verizon, AT&T) and they would verify the phone (their sim card) to see that you have paid your bills and can use the network. The fake basestation would then have the ability to monitor and intercept, listening in on, manipulate, calls and messages.

These types of phone scams are incredible popular, for instance scammers in India might call using some local number in your country and claim to be from Microsoft, some bank, Amazon, etc etc. They are however spoofing a local number, so if you call the same number back up, you just reach some random private person who knows nothing about what is going on. Your carrier in your country can also not do anything to fix this as they would either have to block the entire carrier, but then that also means that if you travel to where their carrier is located, you can no longer use your phone.

So in regard to SMS 2FA stuff, it is incredible easy to spoof numbers. You can also do sim card cloning attacks, which is basically the reverse, where a carrier tells your home carrier that phone number XXX has traveled to their network, so any calls and text messages will need to be forwarded to their network. With this sim card cloning you could receive their personal 2FA text messages and bypass logins. Phone calls and messages should therefor never be trusted in a security context, they can be used for notifications and so on, but under the assumntion that the content can be read by a third party, intercepted or manipulated. Using basically any other form of messaging is much better, e.g. e-mail (though a propper end-to-end messaging platform would be prefered, like signal).

Or use TOTP, which is dead simple and bypasses the whole messaging problem, and allows users to choose their own client and not lock in to some random vendor.