It does make sense from one perspective I've seen. Scammers are using 2FA to lock people out of their own accounts and demand a ransom for the tokens. Happened to a friend of mine a couple months ago.