This is a good analogy unfortunately. SMS is the worst culprit there from my standpoint, given companies use it to send short term credentials (yes they do...) or for 2fa.