It doesn't share the same security benefit. "Prove you can access an email address" is sufficient to reset someone's password, which collapses your 2FA into si

It doesn't share the same security benefit. "Prove you can access an email address" is sufficient to reset someone's password, which collapses your 2FA into single-factor authentication. That is problematic because people lose Gmail accounts all the time, typically because users, in aggregate, suck at password management. For every 100k accounts PasteBin'ed due to insecure practices at a random startup or web bulletin board, another 500 or 1000 gmail accounts get compromised.