A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a backup phone number? After verifying their primary email and password, we would email/text their backup with a code that they have to verify. What are the pros and cons of this recovery method?
The whole point of 2FA is to require the second factor to login. Usually - password+token, in recovery situation - password+recovery key. Something you know + something you physically have.
If you can use secondary email as a recovery option for 2FA, the user account is protected by their password + the recovery email password, thereby defeating the goal of 2FA. The attacker will just go through the easier route.