Now, off the surface: this does sound like a good change (and it certainly has some good intention behind it), but I feel that going the SMS route is like putting the right foot on the left one and moving with that in place and eventually falling and twisting your ankles... painfully.

I would have initially assumed that Valve encourage other developers to use the built-in Steam Guard Mobile Authenticator tech to circumvent bad build uploads, but SMS spoofing is a thing after all, and I fear the upcoming security implementation would probably end up being ineffective when it comes to needing to subside highly malicious behavior such as this.