What happens if you need a password reset with this new two-factor? Wouldn't it still just email you, leaving you with the same problem?
I think they do a pretty good job of emphasizing that there are three things involved here: Recovery Key, password, any trusted device. Any two will allow you to recover the third (except if you lose your phone). Not having any two and you lose your ID forever.