Glenn Fleishman, TidBITS:
Many Web sites and apps now offer two-factor authentication (2FA), which requires you to enter a short numeric code—the so-called second factor—in addition to your username and password. These temporary codes are either sent to you via text message or are generated by an authentication app. In iOS 12 and macOS 10.14 Mojave, Apple has streamlined entering such codes when sent via an SMS text message, reducing multiple steps and keyboard entry to a single tap or click.
I explain just below how this new feature works, but I also want to raise a caution flag. SMS is no longer a reliable way to send a second factor because it’s too easy for even small-time attackers to intercept those messages.
Read the article, especially the section titled “It’s Easy to Hijack SMS Codes”.
Do not fail to enable 2FA because SMS is “not secure enough”. It is much better to have 2FA with SMS than just a single password on an account.
It has also been recommended, to make 2FA SMS more secure (and less convenient) to use a Google Voice number for the SMS, then disconnect Google Voice from your actual phone number so that someone will have to get access to your Google Account to get the second factor.