> 2. Updating 2FA credentials is nonsense. I don’t expect everyone to know this, this is the weakest of the three.

The problem with this is that companies often send out legit emails saying things like "update your 2FA recovery methods". Most people don't know well enough how 2FA works to spot the difference.