So all of a sudden the service in question's security is only as strong as the security of the client's email service? Yeah that sounds like a big nope to me.

So all of a sudden the service in question's security is only as strong as the security of the client's email service? Yeah that sounds like a big nope to me. This 'idea' has been thrashed out a hundred times, even by supposed 'experts' like Egor Homakov who also says things like "You don't need 2FA, it's pointless and annoying for users".