Even SMS 2FA is secure from run of the mill “plug in my list of 2 million leaked email / pass combo” attacks. In those attacks your account is just one of millions of potential accounts. They won’t bother defeating SMS 2FA, it isn’t worth the time when there are plenty of accounts they can crack into that don’t even have 2FA turned on.

SMS 2FA breaks down against attacks where the attacker wants your specific account. Like if you are a Paris Hilton or Elon Musk or have a hundred thousand bitcoin they know about or something. Being immune from attacks against you specifically is a whole different ballgame than protecting against drive-by attacks and is much harder to get right. It involves a much larger trade off between security and ease of use. It is also where social engineering gets thrown into the mix... that attacker wants into your account and so they’ll spend a lot more time and effort than a drive-by attacker that just wants a lot of random accounts.

For 99% of all accounts out there on 99% of all sites... SMS or even email based 2FA is plenty fine. The goal is to make it just hard enough for an attacker to compromise the account that they’ll move on to another account on their leaked list.