The author concludes an SMS code is two-step auth, not two-factor, because the code could be transmitted over Messenger. This allowed the author to authenticate without physical access to the device.

I fail to see how pushing a button makes a significant difference. Instead of sending a code, I'll just ask my friend over Messenger to push the button. Authenticated without any more physical access than with the code system.