Not that this is of help to you now, but my own controversial take is, avoid any services that push 2FA. Especially if they do so aggressively.

This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either)

For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that service.

2FA is a cancer and needs to die. Mandatory-phone-based 2FA doubly so. The only thing mandatory phone 2FA has done for me is it gives websites an excuse to make a phone a "necessary" field, so now I get spam/scam on my phone as well as my email.