Multi-factor authentication is the universally-recommended security control. The problem is that most companies treat MFA as a binary — either it's on or it's off — and don't pay attention to which form of MFA they've actually deployed. SMS-based MFA is the most common form. It's also the form that's been routinely defeated for the better part of a decade. The mistake isn't that companies don't have MFA. The mistake is that they have the version that doesn't actually work.
SMS-based MFA fails to one specific class of attack: SIM swapping. An attacker calls your phone carrier, claims to be you, and convinces customer service to port your phone number to their SIM. From that moment, every SMS code that gets sent to "your" phone number goes to them. They use those codes to take over your accounts. This isn't a theoretical attack. It's the standard attack used in high-value account takeovers, and it's been used against Twitter, Coinbase, and just about every cryptocurrency exchange in the last five years. Phone-carrier social engineering is shockingly easy.
The fix isn't to give up on MFA. It's to deploy the right kind. The MFA that works, in order of strength: hardware security keys (YubiKey, Google Titan, Apple's hardware-backed passkeys) — phishing-resistant by design; passkeys (the WebAuthn standard, increasingly available everywhere) — also phishing-resistant; authenticator apps with the time-based one-time password (TOTP) standard — Authy, 1Password, Google Authenticator, etc. — strong but phishable; SMS — better than nothing, but defeatable.
For a 50-person business, the realistic move is: passkeys or hardware keys for the accounts that matter most (admin accounts, finance accounts, anything customer-data-related), authenticator-app TOTP for the rest, SMS only as a stopgap on systems that don't support anything else. The cost is a one-time hardware key for the people with admin access ($30–50/key) and the time to deploy. The reduction in real risk is substantial. If you're already paying for MFA, make sure you're paying for the version that does the thing.