It's still a little better than security questions in that the layman's recovery codes won't be publicly available or easily guessable personal information.