I am developing an application and users are able to add 2FA to their account. however if a user has lost backup codes of 2FA and logged out of account on all of devices, is it safe making them able to disable 2FA using pre-set 2 security questions ?
I wouldn't say using security questions for pretty much anything is "secure".
There have been so many compromises of personal information, ranging from financial (Equifax) to social (Facebook) it's not unlikely that answers aren't compromised.
Questions like mother's maiden name, school history, first car, etc. Could be part of a breach, or phished out of an email or dating app (commonly show occupation and education history by default now).
The ability to bypass or disable 2FA is one of the current weaknesses in how it's been employed recently. Depending on your resources I would suggest a few alternatives.
Let them pick 'nothing' (and the account is forever locked)
Consider allowing users to use their Google/Facebook accounts to login (you don't hAve to worry about 2FA as that's Google/FBs issue)
let them specify a recovery email (other than their normal email, which gets recovery email)
send a physical letter to the account on file
send an email/call/SMS then wait a period of time (days) and if you don't hear back from the account owner allow a login without 2FA (idea is they would respond if the attempt was invalid/not from them).