Isn't the email provider almost always one of the links of the security chain? Then, why not accept it and simplify the chain?
Usually it is the weakest link in the chain, and you are encouraged to switch to proper 2FA or Passkey instead. So even if the email is compromised, other accounts are not compromised.