The problem here is there are ways to allow for both but they are labor intensive and Google (and other tech companies) do not like things that do not scale because it cost them $$$, they prefer no customer service and automation using Security as a cover for their poor practices.

In this instance if they need a code why is there not a process to hell use US Mail and send a paper code to the registered address of the account owner? Analog is often the solution to these type of problems