Call me paranoid, but if someone gained access to my recovery code (either physically, or via spyware as I printed it out), would they be able to permanently lock me out by changing my security info (Phone numbers)? Would I still be able to verify myself as the owner of the account with this info?
As both phone numbers I have associated with my account are unlikely to ever change (and indeed haven't for the last 15 years), it would make sense to be able to use these as the "last option" when recovering an account. I wish Microsoft allowed users to verify themselves in other ways, such as with passports.
