Back at the start of 2FA rolling out it used to be an absolutely massive issue where the attackers would call up support and tell a sob story and have the account reset and in the control of the attackers.

As a user it doesn't matter how well you manage your own security when that can happen.