With devices that have biometric validation it becomes something you have (unextractable private key in secure enclave in laptop, phone, or hardware token) + {

With devices that have biometric validation it becomes something you have (unextractable private key in secure enclave in laptop, phone, or hardware token) + { something you are (face or fingerprint that unlocks secure enclave) || something you know (pin or password that unlocks secure enclave) } Of course recovery codes are a single factor, so to have it be 2FA still they should not be memorised (to keep them as something you have, not something you know) and be locked away in a way that adds a second factor, e.g in a safe locked by biometric or gated by an id check (bank, notary office) for something you are, or a pin/code/password for something you know. Sounds cumbersome? Maybe, maybe not. It all depends on your trust model + threat model. Maybe a bank is too much and a trusted friend or neighbour is fine for "id check", maybe not. The less you trust the less options you have for recovery. As an example: What if one dies? Is there a recovery procedure? Does it entail someone mentioned in a (paper or digital) will having a death certificate at hand? Then one has to trust the designated person not to fake a death certificate, and so on and so forth.