But that's still not a circular dependency then, that's just the normal case for "I lost all my verification options" and it's exactly what the last option is for.

If I create an account via e-mail and password at a random service, destroy the password and delete the e-mail account, then it's not a circular dependency. In fact, the service has nothing to do with it, it can not know that you don't have access to either the e-mail or the password.

Correct if you don’t have your phone, you’re doomed. This can happen for a variety of reasons and is not an uncommon use case. Theft, damage, upgrades, etc.