This works if you know about SIM swapping on day one of your life on the Internet, and refuse from day one. I probably have hundreds of Internet accounts, and no straightforward way to know which ones use SMS for 2-factor without trying to log in to them all. Further, many don’t use SMS for login but they do use it for password resets. So my only hope, if I want to clean house, is to sit down and try resetting my password on 400+ accounts one by one.

That still sounds like much less pain and effort then if the worst case scenario happens?