SMS definitely works for this as well.

I think security-wise it’s similar to using email. Neither should probably be used for financial or government services, but for most other things they are fine.

Only additional thing to take into account with SMS is that message delivery can be sometimes a bit inconsistent. An SMS message usually arrives in a few seconds, but will sometimes take a minute or even longer, so giving the user a re-send option after 20 or 30 seconds might be helpful there.

Most of the other UX considerations (incorrect phone number notification, code expiry) still apply I think.