The problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sm

The problem is, how can i trust 2fa will STAY the second factor? If one signs up for a service, enables 2fa, and down the road the product design changes to sms to login or sms to reset password, it should disable 2fa until you agree to the new system. sms backdoor should be a completely separate setting than 2fa, but companies dont treat it that way. the sms/magiclink to login has won. the answer to stuffing is to mandate services cross reference their account lists against open leaked lists. thats best practice, and not enough sites are banning known passwords. sms backdoor is WORSE than "nothing" when nothing equals a unique non reused key.