Services having to handle the customer support case where people lose their phone opens up all sorts of vulnerabilities since “oops I lost my phone” customer service pipeline tends to be weaker than 2FA.