I had similar issues: https://news.ycombinator.com/item?id=45451567 (including my personal domain, Dropbox; my Apple account is still MIA...)

We've all been reduced to a passphrase.

When I've lobbed this scenario to the security managers/employees at these companies, they all give me a really great answer:

Q: What happens if a sitting senator gets mugged and they have their printed 2fa codes sitting in their wallet?

A: They have a special number they can call.

After they go get a second phone