Making the option available only to paid subscribers — while also claiming SMS authentication is broken — doesnt make sense, some say. Is it a cash grab?