> Email OTPs, notably, aren't 2FA by definition, since your Email address might be only password-protected

What? 2FA is something I have, something I know. I know my password for your web app, and I have access to a separate account. It's not a recursive 2FA, "it's only 2FA if one of the factors has its own 2FA".