These are recovery options. By definition they make your account less secure by adding additional entry points for both you and a potential attacker. I have 2

These are recovery options. By definition they make your account less secure by adding additional entry points for both you and a potential attacker. I have 2 factor enabled and did some testing. Security options Account Recovery email (phone # disabled) 2 factor Recovery phone #, backup codes All of these require you to provide them. Phone number is given as XXX-XXX-XX12. Email is userna*@domain.com. Failing all of those options, Google asks you to provide an associated email to help with recovery. It then provides a freeform text field for you to explain the situation and expect a response in 3-5 business days. If you have a secondary less-secured email address this could be a viable vector. tl;dr two factor seems to add an additional layer of security / accounts that an attacker would have to compromise if appropriately configured. Recovery options weaken your security and you should be cautious when configuring.