ID can be easily faked. Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these

ID can be easily faked. Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.