2FA isn't the end all be all if it can lock me out by losing a device or an arbitrary number I dont actually own (e.g. sms 2fa)