That's another pet peeve of mine with 2FA, which I didn't mention to avoid posting a wall of text: in many cases (no idea if GitHub in particular is one of them), the second factor totally dominates (allowing you to recover the first factor or logging in without it) so it effectively is 1FA, where the factor is almost always your phone. Lose your phone, and you're screwed.