This is a fair point - not the flakiness or otherwise of Authy, but giving out a phone number. I hand it out like confetti, it being, well a phone number. But now it is the key to my google account.

It's not hard to pluck SMS out of the air and sooner rather than later that's going to be a new attack.

Great one more thing to worry about.