In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, say, a "lost password" flow).
My argument was, from a "moral" perspective, if you enable two factor, you need two factors to make any changes to an account - in the lost password case, the two factors would be access to your email + your second factor.
His argument was, even if you can reset the password with a single factor, two factor authentication is still doing its job: even if the attacker can change your password by gaining access to your email, the attacker is still unable to get into your account because of the second factor, thus, why do we need a second factor to reset?
Is there a logical fallacy here? How do you defend needing two factors to reset a lost password?