But that is not really true for most countries. In my country, to get a sim ported you need to go to the shop and present your identification.

Social engineering is all about convincing people to do things they aren't supposed to do.

In all countries, you have but to prove to some lowly paid telco employee's satisfaction that you are the owner of the number. That is not a serious impediment.

Same here (Denmark with Hi3G), but they often forget. I've had a new SIM issued for myself just by saying the phone number.

Of course that's several orders of magnitudes harder to do than just finding a leaked password somewhere, so it's still nice to have SMS as 2FA compared to nothing. It'll stop the mass bots.

Well, if somebody can mess with ss7 they wouldn't need even that.

Or even porting accidents. If anything goes wrong when you are switching carriers and intentionally having your number ported to the new carrier, you could be left with a non-working number until you get it resolved (which can be difficult because your phone is no longer working...).

And even if nothing goes wrong, it can take up to a day for the number to port in the US. That's a day without being about to login to anyplace that requires SMS 2FA.

A TOTP app on my phone, on the other hand, works fine regardless of whether or not my phone number currently works with the SIM in that phone.

Some countries resolve the porting issue by having a list of numbers that have been ported, so that banks (for example) can check that and not rely on it if the port happened in the past two weeks (also, for example.)