You should definitely be using 2 different forms of 2FA with important services like your email address, and one of them should not be SMS. Personally I use a phone app and a hardware key.