> Genuine question: what if the recovery asks for a 2nd factor that's e.g. the device which you lost? Is that common?

Instagram does something similar. If you have no logged in device and you reset your password, good luck getting in, cuz it wants you to log in a device "it recognizes" else it won't let you log in.