That's my point. Adding an SMS number to your account reduces the security of your account to one-factor SMS authentication.
I compromise your SMS. I initiate password recovery, and tell Vanguard "I forgot my password -- but look! It's still me! I can receive SMS challenges!"
Vanguard requires you to enable fallback SMS 2FA before you can enable U2F, which results in a net decrease, rather than increase, in account security.
That's my point. Adding an SMS number to your account reduces the security of your account to one-factor SMS authentication.
I compromise your SMS. I initiate password recovery, and tell Vanguard "I forgot my password -- but look! It's still me! I can receive SMS challenges!"
Vanguard requires you to enable fallback SMS 2FA before you can enable U2F, which results in a net decrease, rather than increase, in account security.