I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become more harmful and it might open holes, as opposed to being without 2-step at all.
For example: with 2-step SMS authentication, you need to set your mobile number in your profile. The mobile number in profile, are generally being used can be used as recovery method by most sites (including google). So, theoretically, if an attacker doesn't have your password, but can intercept GSM/SMS, then you are in more danger because he can click "password recovery" and then the website will try to send validation through SMS to reset your password.
So, that seems like a proof, that in this case, you are in more danger then if you were without 2-FA at all.
Is this theoretically true/possible?