If the assumption is that users set bad passwords, hence the need for MFA, then why should the MFA implementation assume their email account is any less comprom

If the assumption is that users set bad passwords, hence the need for MFA, then why should the MFA implementation assume their email account is any less compromised than the account we're trying to protect? Sure, you could say: P[password X is compromised] * P[password Y is compromised] <= P[password X is compromised] ...and thus you have increased the security of the account. By the same math, I say that you've barely moved the needle. If your password recovery flow only requires the user to enter their email, then you've done nothing to raise the security of the account. At that point, the only important password is the one for the email associated with the account- the password for your login system, and all others like it, can be considered mutable and temporary. If you have "we sent you a code" MFA and email-based password recovery, you have probably de-incentivised hacking of your service. But, the approach also puts a target on the email service provider's back.