Not saying you're wrong, but what's your logic? It seems to me that control of 99% of my accounts already reduces to having control of my email account, because account creation and password reset processes depend on my email. I've never understood why only a handful of my service providers let me select email as an option for 2-step verification.