Who's to blame?
Not Facebook or any other social media site. This is a weakness in the telecom network.

While the telecoms are definitely to blame for their crappy security, I also blame Facebook, Google, etc. too.

I always got pissed off when Gmail recommended to me to add my phone number for "added security". And I always refused to do it because I knew it would make my existing password recovery system less secure exactly because of these sorts of attacks.