same, a simple habit that is secure, I use it always with maximum privacy. One day you will be in a rush, under stress, affected by age, and use your old habits with a valuable asset...

Not if the org uses SMS auth as a recover method for your "lost" password

Also putting a phone number into a DB means the attackers who dump the DB now have a very effective way to phish or exploit you with a large attack surface.

I generally don't let my team enter phone numbers into their account data.

But it should be the last resort. It makes sense why it's being phased out