I actually think their existing policy is not so bad at all, but it should notify you. So: 1. Changing recovery emails should require 2FA 2. Changing any 2FA

I actually think their existing policy is not so bad at all, but it should notify you. So: 1. Changing recovery emails should require 2FA 2. Changing any 2FA policy should email your recovery email It does, after all, still require a password. We're really talking about a very, very specific use case where the attacker has a lot of access to an existing session. I myself have had a phone break and rushed to a computer with a valid session so I could easily reset. It's really a huge UX win, and probably massively reduces 2FA burden/ support burden.