The attacker would have to steal the password and SMSjack someone; that’s a fairly tall order (maybe feasible for targeted attacks, but it should be sufficient to thwart opportunistic attacks.) The problem is that many sites allow password resets with the SMS, thus rendering it 1F, as GP said.