Cellular networks should definitely be considered compromised networks. I ditched SIMS some time ago. https://jmp.chat/ and MySudo are both good options.
If a SIM is absolutely necessary for 2FA, silent.link provides international inbound call/text sims that roam on networks, providing more privacy.
If the service is one of the few that does not accept VOIP/XMPP (Jabber) numbers at first, you can often update to one after the initial text verification.
As far as the VPN attack, I'm familiar with it. It's just one more reason to use Android/GrapheneOS and Linux/QubesOS. Apple still hasn't fixed multiple VPN bipass vulnerabilities on iOS...since 2020.