Sure, they may have nefarious purposes. But it's also because most people have a working recovery path when they drop their phone in the river.

2FA without a recovery path that people will actually prepare for is a recipie for locked out users, and that's going to mean your customer service gets all the sad stories and hopefully has no ability to do anything about them.

It's because just about everybody has a phone.