This is intended as a second piece of authentication to be used every time you log on, so it's not for resetting passwords at all. So it should always increase

This is intended as a second piece of authentication to be used every time you log on, so it's not for resetting passwords at all. So it should always increase security. I agree about bad password resets though. Developers need to consider a password reset mechanism as an alternative login method, and make it at least as secure.