I am the CEO of TextPower and wanted to address your question directly. Thanks for taking the time to put together a thoughtful query.
I think that you have to step back and look at the bigger picture here. TextPower's 2FA product TextKey works on the basis that you have to have physical possession of the phone, including the SIM card in it to authenticate properly. If you physically possess more than one phone, you can use any one of them, but only the one that is registered with TextPower can be used to authenticate using the TextKey 2FA. If you have a phone with a replaceable SIM card (standard GSM phones such as those found on AT&T or T-Mobile) you can move that SIM card around to multiple devices that have replaceable SIM cards. That is because you are in physical possession of the SIM card that carries the UDID that the phone uses to communicate with the network. Note that the phone number DOES NOT appear in the SIM card. Only the UDID identifies the physical phone. The UDID is a really long unique number and is what the carrier sees when a call or SMS goes through their system - they don't "see" the phone number.
So, could you clone a SIM from a phone and then use it? In theory, yes but in practice that is extremely difficult to do and highly impractical (and improbable) from a hacking standpoint. Why? Because to clone a SIM you would have to steal someone's phone, remove the SIM card and then have access to a burner that could make a SIM card. You'd have to have a supply of blank SIM cards. By the time you got that done, the owner would probably report the phone as stolen and their carrier would invalidate the UDID rendering your stolen SIM card as useless except for providing a marvelous way for the police to track and arrest you. (The number of criminals arrested in this manner is now relatively large.) The owner of the stolen phone/SIM Card could also stop you by simply un-registering their phone with TextPower.
Furthermore you might think that you could steal someone's SIM card, clone it and then replace it in the original device without the owner's knowledge. Unfortunately what happens in that case is that besides all the problems listed in the above paragraph, you will have created a couple of other problems. (Of course you first have to manage to steal the device, clone the SIM card AND replace it without the owner's knowledge - no easy task - but we'll let that go for now.) The additional problem which you've created in this situation is that if the original device that you managed to steal and return was powered up when you powered up your device with the stolen/cloned SIM card, it would fail network registration because of the duplicate UDID (yes, carriers watch this stuff - very closely). If your stolen device was powered up first then the real owner of the SIM card could not register their device. They would likely report this quickly to their carrier who would discover the duplicate UDID and then invalidate it.
Is TextKey absolutely un-hackable? We certainly wouldn't say that. Like any authentication scheme, there are theoretical ways to break it. In practice however, the ways to break it are way out of the range of anyone with less than huge resources and the
willingness to use significant thievery and take considerable risk. That's why, while we don't promote TextKey as being "un-hackable" we do think that it is more secure than other 2FA methods, particularly those that use a mobile-terminated SMS where a code is sent to the phone, thus opening the authentication process to a MITM/MITB browser attack on the website in question.
I hope that this answers your question clearly. I am happy to address any more detailed questions or concerns you may have and do sincerely appreciate your interest.