3 ms·

I think the real issue is phone based account recovery rather than 2FA. It effectively turns 2FA into 1FA.