I would argue that a phone number barely counts as “something you have” because of how easy it is for attackers to gain access if they really want it. It’s more like “something your cellphone company has and lets you use”. I would rather have email 2FA over SMS because that account actually has a strong password and real 2FA on it. The truly terrible part is you can’t disable either auth option so any attacker has two attack vectors.