I disagree. To access my email, I need to do one of a few things:
1. Use a device I already have authenticated to access it (something I have)
2. Log in to my email again, going through Google authentication, which includes a proper 2FA system (password plus either Yubikey or TOTP auth code), and is protected by Google's relatively strong security.
3. Log into my domain registrar and change my DNS to point my email somewhere else. This is also protected by 2FA but is probably an easier vector to gain access to my email.
4. (hypothetically) Hack Google (either by hacking the password reset flow, or hacking their actual backends) and gain access to my email messages. This seems relatively difficult but I include it for completeness.
If I want to gain access to SMS sent to my phone, I need to do one of a few things:
1. Use a device that is already authenticated, my phone with its SIM (something I have)
2. Log into my T-Mobile account and order a new SIM
3. Contact T-Mobile support and convince them to SIM-swap or port-out my number
So I get where they are coming from, but IMO neither SMS nor email proves access to "something I have". Both have relatively easy recovery processes that allow someone who has _nothing at all_ to gain access to my messages. SMS just happens to be run by legacy companies that do not take security nearly as seriously as the average modern email provider. Outlook, Google, Proton, Fastmail, etc all have better security than T-Mobile. They (and other major carriers) are famously bad at ensuring that they do not SIM-swaps. Hackers buy access to low-level customer service credentials and offer swaps for $100 to $10000 USD depending on the target.
If you truly want to prove "something I have", then you need to go to a hardware token issued by a trusted vendor, potentially with a key baked into it. These were quite common in the past. TOTP and HOTP used on a hardware token predates their use on phones, and they are still issued for things like wire authorization by business banks, or even PayPal (I think). Or you could use WebAuthn or PassKeys or whatever they are called now, binding the token to the TPM in your general computing device, or using a specialized security processor like a YubiKey or Ledger.
I understand why SMS might be accepted as a "lowest common denominator" second factor. It is certainly better than nothing at all. It just should not be seen as more secure than TOTP or email IMO.