[pdpi]

An attacker gaining access is one problem.

An attacker disabling and then promptly re-enabling 2FA (thus locking me out of my own account) is a different problem altogether.