Yes, that’s true. It should really only be used as second factor and not as a single factor for password resets. I’ve seen this too, and it’s awful. If sms is used for password resets, there should be at least an email notification and a waiting period of a few days.
Not if it can be social engineered into a 1FA password reset. Better not to give companies your phone number at all.