> But you can also gain back a phone number

...at which point the attacker has already taken over all your important online accounts and changed them to a different phone number.

Not without your password. The comment I was replying to specifically referred to the phone number as a 2nd factor. This excludes services like Twitter where a phone number can be the sole factor used to reset your password (which is awful security, obviously).

Also, you're specifically talking about SIM-jacking. The vast majority of people have upgraded phones, or broken or lost and then replaced a phone, far more times than they have been SIM-jacked. What do they do about their TOTP tokens in those scenarios?

That depends on the way the phone company operates surely? You can’t do it if you are abroad, or if it’s a prepay SIM and the phone company doesn’t know your identity. Some telcos will give your number to somebody else if you don’t connect with the network for too long.

Sure, you're totally right that in some cases, physically losing a phone also means loss of that phone number. But in 100% of cases, physically losing a phone means loss of those TOTP tokens.

For the vast majority of people, that's a dealbreaker, in spite of SMS being deeply flawed, as the comment you originally replied to said.