Recovery has to work precisely when the strong path can't
Account recovery restores access after its owner has lost the ordinary means of authenticating — a forgotten password, a lost second factor, a replaced device. By its very purpose, recovery has to succeed even when the account's normal, strong authentication is entirely unavailable, which means it necessarily provides some alternate path that gets around whatever rigorous authentication the account otherwise requires for everyday access.
This makes recovery a structurally different security surface from ordinary login, worth designing with the same rigor rather than as an afterthought bolted onto a strong primary authentication scheme: an account protected by excellent multi-factor authentication is only as strong, in practice, as whatever recovery path exists to bypass that multi-factor authentication when someone claims to need it.
Where recovery quietly undoes the primary protection
A recovery flow that falls back to something weaker than the primary authentication it's meant to substitute for — a knowledge-based question, an easily-spoofed email loop, a support agent persuaded by a convincing enough story — quietly erodes much of the protection the strong primary method was providing in the first place. An attacker doesn't need to defeat well-designed multi-factor authentication directly if the recovery path meant only for genuine lockouts turns out to be the softer target.