I spent a little time trying to decide whether GitHub's 2fa was genuinely an extra factor whose compromise (with an uncompromised password) wouldn't weaken secu

I spent a little time trying to decide whether GitHub's 2fa was genuinely an extra factor whose compromise (with an uncompromised password) wouldn't weaken security vs a situation where it hadn't been set up at all. In that case, presumably I could embed the totp key in a bookmarklet in the conveniently-sized 'public bio' field on my profile so I can complete it on whatever device I happen to be using, and effectively opt out? But I'm really not convinced they aren't fuckwits and wouldn't treat the 'second factor' as an authoritative single factor in some circumstances (e.g. password reset) which wouldn't be unauthenticated if 2fa wasn't set up. I'm also not convinced one can even contact anyone at GitHub clueful enough to answer that question authoritatively nowadays rather than reading off a script.