SMS is a really dumb way to do 2fa, can we get a proper authenticator setup?

1. Its not the only option. In fact its not even the primary option.
2. Apple's two factor authentication will send the code to a trusted device as a system message first not an SMS. If no trusted device is available, then you can choose to have the code sent via SMS or even a voice call, but its entirely up to you to use this mechanism. If you have a trusted device, you never have to use SMS.
3. The SMS option requires a number be set up ahead of time as a trusted phone number on your Apple ID before it can receive codes, you cannot just randomly enter a phone number to get an SMS. Its fairly secure since the primary purpose of TFA is accessing your Apple ID, and you cannot set up a trusted phone number for SMS without having access to the Apple ID already.
4. click here ➜ Use two-factor authentication for your Apple ID on iPhone - Apple Support

They offer About Security Keys for Apple ID - Apple Support

Send your feedback directly to Apple at Product Feedback - Apple

JDD_ wrote:

I do not use apple products. As I mentioned, I have to have an apple ID to manage my companies app developers.

Which is not something worth risking my number leaking.

If FIDO tokens and a recovery key utilized together are inadequate for your MFA requirements, then send Apple your feedback with your comments and your preferred alternatives:

• Product Feedback - Apple

Why would you be using a personal phone number for business needs?

Just don’t forget the dummy number you use, if you do and get locked out you are SOL.

We all run into things at work that aren’t ideal, but figure out a solution within those limitations.

1. As long as the dummy number can get SMSs messages it should work. Why do you assume it will leak from Apple? Apple has no known data leaks of any kind.
2. Unless you are continually signing in from a different device or web browser or never trust the browser you are using, you should only need to get a 2FA code once in a very long while. Once the web browser and device have been trusted, it should let you log in without the need for a code.
3. Why do you assume outsourcing the 2FA process to a third party authenticator app would be more secure? You trust Microsoft's Authenticator or Google's Authenticator over Apple's own internal mechanism?

I much prefer Apple's higher security method, that having to use other authenticator apps to get a code.