Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.
Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human.
Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting
Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof.
Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.