this is 100% true, If you are using a service like google voice for SMS, then this is technically a vulnerable service potentially. in addition even traditional services can have a vulnerability. Some social engineering, a new sim card activation, and poof you now have their SMS coming to your device for 2FA.
MS only uses the phone number to verify the device your 2FA app is installed on. once done then it uses an encrypted process. Google is even a touch more cryptic as their process is not automated, you have to scan a QR code or enter a string of digits to set the algorithm.
"For now, services can continue with SMS as long as it isn’t via a service that virtualizes phone numbers — the risk of exposure and tampering there might be considered too great."