The option for a delay of is great. The option of adding a custom security question/password etc. is even better. The option of completely turning off recovery is also great. The ability to have your solution on multiple devices without a need for a mobile phone number based recovery is great as well.

I hate it that Twitter forces you to enter a mobile phone number even when you set up an authenticator code generator as 2FA.

Oftentimes the weakest link in most of these services is the account recovery part.

When we set up the self service account recovery in saas pass password manager and authenticator we added all of these customizable options to mitigate against potential SIM Swap attacks.