The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then b

The main problem with email 2FA is that if someone gains access to your email account, they can reset your passwords on many sites and services. They can then bypass both the password (by resetting it) and the 2FA (by simply reading your emails). Even better, if you re-use passwords, they can use one password to access your email account and the service, and get the 2FA token via email.