What if somebody has compromised your email account and want's to take over your bank account. They do a password reset and the 2F is sent to the same address t

What if somebody has compromised your email account and want's to take over your bank account. They do a password reset and the 2F is sent to the same address that is compromised. Not very safe. Same thing can happen with a phone but, usually, when someone has their phone stolen, it gets quickly reported and disabled. When your email is compromised, you may not know about it and even if you do, how long will it take to disable the account or recover it?