It might be legal and maybe even legitimate, but OP said:
> This isn't a "fuck the people who don't have regular access to a phone, they don't matter" situation.
So yeah, those people don't matter (enough) in the sense that it's not worth to offer more methods of 2FA. Let's not pretend otherwise.