Nobody would handcraft a password reset flow that ignores the users' email and 2fa settings lol

Also I've used Meta's old password recovery system. It's not possible to do this in that version. The chatbot is what makes this possible.