2FA are not the safest option, but what really concerns me is the recovery of those 2 FA set up being the biggest problem... If few weeks later you called in the company and pretended to loose the 2FA device, the recovery process today is very vulnerable to an attack. This needs to be corrected.... I dont kow the best way, but may be use biometrics for recovery ? !