What about the 99 other places granny needs to regain access to after the much more common broke or lost phone many of which doesn't have a meaningful amount of customer service.

I see no reason not to use password + one of multiple 2FA methods so the user can regain control.