Help-desk social engineering

Every password reset process is an authentication system, and it is usually weaker than the one it can override.

Whoever can talk a help desk into resetting your password or moving your second factor to a new phone does not need to defeat any of your security. They only need to sound like you having a bad morning. Several large incidents have started exactly this way. Whatever standard you hold the front door to, the reset route needs to meet it, because an attacker will always choose the easier of the two.