[entropicdrifter]

I mean, that's really on the user for not setting up more than one 2FA method for their highly critical accounts

[colordrops]

That's for properly engineered services. There are many services that won't grant access without your email after auth has expired.