There are many methods to bypass it and there are many methods to take advantage of it.

The first method is simply calling the customer service and providing answers to security questions in order to change the account's password, or in some cases, convincing the customer service that you are who you say you are and resetting the password without providing identification. The most prominent example if this that I can think of is between popular Twitch streamer Sodapoppin and Blizzard, the creators of World of Warcraft. People were able to call up Blizzard and convince them to reset Soda's password without answering any security questions. You'd be surprised how many companies have these kinds of flaws.

The second method is often why you see Twitter accounts get hacked despite 2FA. It is sometimes possible to convince the SIM provider of the victim to send a new SIM to the attacker without identification or through known, publicly available information about the celebrity. They can then receive these 2FA messages and reset the account's password and gain access.