[bloppe]

2FA is as strong as the strongest link, not the weakest. You need both factors, not either factor.

In this case, it's just that one of the factors has a weak backup option.

[avh02]

Until the "try another way" option is a weaker form of 2fa, like sms.