Last I looked a couple of years ago, GitHub 2fa has a lot of shoddy gotchas actually. There are a handful of GH issues on it with tons of comments.

For example it was impossible to remove/delete a phone number 2fa, even if you registered multiple other 2fa sources like security keys.