If you 2FA the email account, you risk locking you and them out permanently for many services. I've written some about this. If you care to read it:
https://www.go350.com/posts/now-they-have-2fa-problems/
Also, if you 2FA other things and aren't really careful, you may lock them out even if they know the password and/or are able to reset it. That is by design.
This problem is growing larger every year as more sites enable or mandate 2FA. It's impossible for humans to manage this at scale.