Email and SMS are the most retarded 2FA in the wild. If the code isn't generated in a device you own, then you don't have control over it