For me the main takeaway from the article is that the robbers have become sophisticated enough to perform phishing attacks to get iCloud credentials.

Also, the author says using Authy is a good alternative as it provides encrypted backup, but account authentication is via OTP to the registered phone number, so it brings back to the same problem. Is there other alternatives to this?

Putting the sim in another phone is a nasty trick. Seems to get around 2fa.

If what 2fa is protecting is more important than your phone, I think a SIM PIN is a good idea.