I suspect there is a common use case where someone’s phone gets stolen so they lose the 2nd factor and have to disable it or add a new device because they don’t have the backup codes either.

As with all things security, there are trade offs.