They could also ask you to enter the code from your hardware token, and accept whatever code you type. Phishing is a different story, not really related to SMS.
> Also, in most countries with any sort of number portability a minimum wage employee at a phone store is authorised to override this
I don't know about other countries, but here in Israel when you port to a different network a code gets sent to the number you're porting, which you need to provide to the new network.
Where there might be an issue is if you claim to have lost your SIM card. This happened to my wife recently - they did give her a new one in the store, but I instantly got an email telling me about it, so it's not so easy to do that undetected.
To the extent there's a "code from my hardware token" it's some blob of data processed by the web browser and there's no way for a normal user to get it let alone enter it into a phishing site for whatever good that would do.
If you're going to bother overhauling your authentication strategy you need to actually counter real threats like phishing. WebAuthn does that. Deploy WebAuthn.
Nope.
Nobody's going to be able to give you this reassurance, or least they shouldn't, because it isn't true.
It may not even be better than nothing. For example you get email that says your bank has detected large withdrawals from your account and to fill out a web form if you want them to block these withdrawals. The site linked from the email looks reassuringly authentic, and you get a SMS as you expected during the login process. Genuine right? Nope, you've just been phished and you've helped your attackers by giving your real SMS code to their phishing site.
Maybe if there hadn't been the seemingly genuine SMS message you'd have slowed down and realised that the bank's name isn't spelled "Furst Springfield Bonk" or that it wasn't previously hosted on a $1 per month bulk hosting site under a directory named "/wordpress/cgi-bin/cgi-bin/cgi-bin". Maybe not. Either way the SMS didn't help you.
Also, in most countries with any sort of number portability a minimum wage employee at a phone store is authorised to override this (after all they just checked your photo ID right? Or at least they clicked a box labelled "Check photo ID") and issue sims with your number activated to... well, they're authorised to give them to you, but they can give them to the hot guy who paid for shots for them and all their friends last night. It's only a part-time job, worst case if the boss finds out they get fired. So don't tell the boss.
There are plenty of problems. You should not be relying on SMS for multi-factor authentication in 2021. If you still are, make your way calmly towards the exits, find a solution that actually works.