fair enough, but what's the actual point of 2FA if it's so easy to override?

the alternative is people losing their accounts and people aren't willing to allow that. i do think that apple does this a little better where they try everything to contact you in every way they know and it takes a week to get access. at a minimum to change your email it should require a week of waiting to see if the user can access the original mail to the hand off.

In some cases, checkbox-compliance with customer requirements.