The limits described in this article are where all components are part of the same system - the 2FA device (iPhone) can be disabled from the same system (iCloud

The limits described in this article are where all components are part of the same system - the 2FA device (iPhone) can be disabled from the same system (iCloud) that is protected by the 2FA device. Thus compromises had to be built into the system to allow device recovery, since that is also part of the same system. Were iCloud 2FA provided by an Android device (or PC or Blackberry or RSA keychain), this problem could be easily obviated.