Except that you might need to first setup phone/sms 2FA to then be able to setup any other 2FA auth, without being able to fully disable phone/sms based 2FA aut

Except that you might need to first setup phone/sms 2FA to then be able to setup any other 2FA auth, without being able to fully disable phone/sms based 2FA auth. I'm not sure if it's still that way, but when I setup 2FA I could not directly setup non phone/sms 2FA (e.g. Yubikey, non google authenticator apps). Worse even through I then explicitly disabled phone/sms based 2FA google at some point just switched it back one. Worse there had been multiple times where having the 2nd factor but not the first (password) was enough to combine it with social engineering to completely take over an account. Some security researcher go hacked by this. Again I'm not sure it's still that way, but I don't trust Google anymore to not accidentally but a 2FA related vulnerability which makes the account less secure into their authentication flow. They either don't care (likely) or don't have the competency to handle this (unlikely). Well it's one of the reasons I'm slowly moving away from Google.