it's less terrible if it's purely for multifactor, but a surprising number of places will use it as the only factor for account recovery