Also, you can steal someone's phone account in about a hot minute. Watch:
https://youtu.be/bjYhmX_OUQQ?t=98
This phishing test company has one of their employees steal a reporter's cell phone and it's amazing. She basically plays a crying baby on youtube and just grabs the account without knowing anything...
(posted by @nbadg https://news.ycombinator.com/item?id=12598989 )
2FA using a phone number isn't really 2FA, as you've said. There's a reason this method has been deprecated by the NIST and other folks making recommendations about this.
Used correctly, their TOTP app is a real second factor, because it only lives on a single device that you have.
There are obvious reasons Google does it this way, and it is probably a net increase in security, because a phone as a single factor is less often compromised than a password as a single factor. But I don't like calling that particular arrangement 2fa.