Not many things say "We think we understand online security but we really don't" than forcing users to opt-in to SMS-based 2FA.