Sure, they may have nefarious purposes. But it's also because most people have a working recovery path when they drop their phone in the river.

2FA without a recovery path that people will actually prepare for is a recipie for locked out users, and that's going to mean your customer service gets all the sad stories and hopefully has no ability to do anything about them.