Webhook vs polling for SMS verification codes: what actually breaks in production

Phone verification looks like a two-hour feature. You send a code, the user types it back, you...