There’s no such thing as perfect security of course, but in this case it’s because having my phone number and address isn’t the same as having my phone. So short of a SIM clone or something like that, the MFA on those accounts still adds one layer of protection. There’s also “security” questions and, protip, the answer to what high school I went to is not which high school I went to. It’s just another, different pass phrase.
I’m just not worth the trouble to beat all the extra layers of security when there’s millions of people who’s money is far easier to get at.