I think it's much more secure, both for you as an individual user and for the service as a whole. First of all, if an attacker has access to your email account

I think it's much more secure, both for you as an individual user and for the service as a whole. First of all, if an attacker has access to your email account, then you're doomed. The attacker can reset your password, lock you out, and acquire all privileges. Access to the email account is a fundamental assumption that every service does, and in fact that's how they let you even change your password. For you as a user, it means not having to remember an extra password. The drawback is that email connectivity may slow down your login, and clicking the link could not work perfectly on mobile device. For the service as a whole, it means not storing passwords, and thus not risking to leak passwords, and not being at risk of ATO due to reused and leaked credentials. However this turns authentication from something the user knows (password) to something the user has (access to, their email account). Strictly speaking, this reduces the scope & security of 2FA solutions.