A while ago I worked on the 2FA access feature of a large online service.

The fun crypto-related and login-path stuff took maybe two weeks.

The remaining months were all about account recovery. It's really hard to do well, and unless you hire support staff it just won't work.