What do suggest then? We physically go to Blizzard HQ with a govenrment approved ID to connect? Because anything else is hackable. Heck, even that is.
The thing is making it harder/more expensive without bothering the player, and using an authenticator goes in that way: a normal player sees no difference, while the spammer is forced to get a new phone number is banned.