One point missed by the article is visibility: even with SMS-2FA, I at least know when my password is being used by someone else (modulo sim-based attacks). For example, if my password manager gets hacked, and a password leaks. I think the overall conclusion is still right: it's a rather minor concern and let's come up with a proper solution and not waste the developers' good will on this one.