It's potentially worse than nothing because you can steal someone's sim card and then use that to reset their account password. This is because (as in almost every company that uses text messages for 2fa) you use the sms to authenticate the reset.