recovery keys = "write down your password" which they've been telling us to not do for years

recovery email/phone = same threat model as regular passwords, and it's a big crack, all the time somebody bribes somebody at a phone carrier to take over the phone number of a crypto whale

Practically low-touch services are going to have to resort to these things, but they render 2FA performative.

Now at work 2FA is OK because I can go down the street and show my face and ID to the people at CIT and I don't mind it for my bank because their cost structure lets me do the same.