What keeps an employee from impersonating a user by registering a new device and intercepting the confirmation code? The code must be somewhere in their systems

What keeps an employee from impersonating a user by registering a new device and intercepting the confirmation code? The code must be somewhere in their systems for the time being, so at least one employee must be able to get it. Then they can see everything the user can see. (Assuming the user has the default setting of no 2FA.) There are probably more ways to get to the data. Splitting keys in different jurisdictions seems like security theater.