I think another lesson in security is that 2FA are sometimes completely broken because of real use-case where the user lose his second authenticator device. This is one of the reason I'm really iffy about setting up 2FA on my own accounts.