The flaw of the cooldown solution speaks for itself.

Still it's something like a second factor (or even, literally, overriding might require 2FA).