Isn't SMS 2FA immune to SIM swapping attacks when the SIM is an unregistered PAYG one?
i.e. there is no way to contact the carrier and get the number reassigned to a new SIM unless one first registers the SIM, and hence binds the number to a known identity.