Everyone I know who works in security has seen Some Stuff. But I've never seen a website that told users you must remove two-factor authentication.
I'm no fan, but if you are bleeding money, and SMS 2FA is costing you, telling people to move to a different 2FA doesn't seem so terrible.
<please don't shout at me>
