The big problem is that apparently if you have a phone number linked to your account, it can be used to reset your password even with TOTP 2FA enabled which to me, is bonkers: https://twitter.com/TimBeiko/status/1700659107764785336

Twitter was requiring phone numbers for a while for account verification and I had mine attached from pre-history, but have obviously removed it after people have been pointing this out as an attack vector.