And that's the whole point of the conundrum. If you can talk someone into disabling 2FA then someone posing as you could theoretically for so as well.