Hmm. Not sure about that. There are some obvious vectors.
In particular, MS and Apple's 2FA relies more on phone numbers to receive SMS than an app or somesuch.
But there are now plenty of carriers that have their own IP based services for delivering said SMS (For example, TuGo in the UK). If a user doesn't know these services existed, they might not even have set up the user name and password for such a service. And as such a social hacker can find out security question information, go and set such services up based just on an account password, and then intercept the codes for 2FA.
Untrue. You can set up verified icloud devices to receive messages through an Apple notification and not regular SMS.