You can choose where your six-digit sign-in code goes. Email still works exactly as it did. If you would rather have it as a text message, you can now use your mobile number instead — useful if your email is slow to arrive, or if you are signing in from a phone and would rather not switch apps.
Codes are sent from SIMCOAI, through the same protections as everything else we send. The code itself is never written into our own records, there is a firm limit on how many can be sent to one number in an hour, and premium-rate and satellite ranges are refused outright — those exist to stop somebody running up a bill by asking for codes they never intend to use.
Replying to one of those texts now gets an answer pointing you at somewhere useful, and replying STOP stops them. Before this, a reply reached nothing at all.