https://transparencyreport.google.com/safer-email/overview?h...
Password reset emails are already extremely common and a way of implementing the "second factor only" method in the OP.