Bingo. Which is why the second factor in 2 factor authentication is "something you have".

It's also why SMS text messages do not meet the criteria for 2 factor authentication - it's trivial to social engineer phone companies into moving a phone number to a new phone - presumably one you would not have. Authentication apps are a PITA to move to new devices because having a way to move your keys around without some reliance on meatspace defeats the whole goal of "something you have".

> it's trivial to social engineer phone companies into moving a phone number to a new phone

Obligatory "if you're in the US, then yes - elsewhere, it depends". In the UK, obtaining a PAC code is a bit more complicated/non-trivial for the attacker. I'd consider it fairly safe to use SMS 2FA over here.

My login specifically? Probably a lot less than "admin" "root" or similar common things script kiddies run. But if it is on port 22, the dictionary will probably be attempted.

This seems tangential unless you have per-user permissions on your front door lock (which people may if they use NFC, etc) but even then, likely have a regular physical key as backup, which for all intents and purposes would be akin to the root account.