I think it’s biggest problem is when used for account recovery and password reset, not login 2nd factor.