That would be fine, I can live with choosing two of those for any given account.

What I hate is when the company offering the service forces its choice on me. I may be reliant on logging into some specific account without access to my phone, but then along comes company X and says “NOPE! Your account security is more important than you being able to access your own stuff. We’re completely on board with locking you out of your own accounts in the name of security.”

To be clear, I’m talking about personal accounts. Those on a network where I’m responsible for preventing a breach are another matter of course.