Yeah no. We've arrived at this point in time where username/email with password login is considered not good enough and so if you login from a new location, you'd have to submit a one-time password from SMS or a 2FA app (fine if it's just standard TOTP, extremely jeeted if it requires specific platforms like Authy or Microsoft Authenticator). And as others have said, sometimes you have to verify other details like credit card number and phone numbers too.
Point is username + password should be enough. Go read it again.
So, you're missing the point. This whole procedure is about restoring access in case you lose your username and/or password. It makes sense, and in earlier days of the Internet, the 2FA was your first pet's name.
And that's where you're wrong. Account recovery is inherently broken. Security questions? If you fill them in honestly, the answers could probably be found with a bit of OSINTing if the target has terrible opsec.
Sure, that's why it isn't done anymore. Probably half the darknet population knows my first pet's name by now. But those things have been replaces by TOTP and other measures, and they have worked very well for me, but I still have that phone number and e-mail address from 2001, and a few more for redundancy.
Username-and-password logins have been a problem since they were first conceived. 2FA fixed this for the most part.
Traditional TOTP can be phished. Unfortunately hardware keys are what are required. I hate Authy and Authenticator and think the phishing is unlikely, but IT departments won't budge on it.
A phone number / CC is often required because services will be abused otherwise.
I agree. However much of this data collection is now mandated by law.