This is on purpose, otherwise anyone can just register a new phone including an attacker.

In these contexts, you should have a recovery mechanism in place such as recovery codes or a recovery email.