This is not speculative. I've literally had to help relatives with this exact security breach.
Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your only authentication factor is much less secure than a password + 2FA.
An authenticator app, such as Authy, faces none of those security issues.
There's no reason to require phone or email; let the user choose their preference.
This is NOT true. I used to live in part of Cornwall (South East UK) which has no mobile tower coverage.
So, no mobile phone #. That became an extraordinary PITA once some idiotic major companies decided the "everyone has a mobile" meme was true.
Mandatory 2FA using mobile number only text messages -> worst idea ever. :( :( :(
Chase bank in the US decided to break this recently. Like you, geography means I don’t have a mobile in many scenarios.
Furthermore, almost no service in India uses passwords, everyone uses OTPs. And initially people were not aware and there were lots of social engineering fraud, but now everyone knows not to share OTPs with others, and frankly this looks like a far more secure method than the password based auth systems prevalent in the western world.
Further there's an even bigger incentive in places like India - easy control of spam. I am not aware of any easy method to procure phone numbers here without linking it to your identity, so it becomes much harder for spam account creation. You could call this draconian but I don't see any problem with this behavior from the company's perspective.