More like using a key that hasn’t been used in I over 30 days and needing to wait on a text/email.

Also text or email is a bad second factor and an implementation problem. TOTP is better. Passkeys way better and are so simple once you start using them.