Sms is vulnerable, because IMSI catcher, a MITM hacking technique. The authenticators are better. It is worth to use FOSS app. On Android it is e.g. andOTP or Aegis if you want to use Google Authenticator compatible app.

2FA can contain 2 of 3 different kind of auth. Based on:

- knowledge (e.g. sms or authenticator)

- possession (e.g. mobile phone)

- inherence (e.g. fingerprint)

So you have to chose 2 different. But some authenticator accept fingerprint instead of numbers provided