Thats totally fair and really scary since so many services think 2fa means texting or calling a phone number (my bank for example)