Agreed, this is exactly how 2FA should work. Allowing support staff to deactivate 2FA is a massive security weakness.