You seem to be doing nearly everything right. Your only issue seems to be 2FA cloud backups, accessible via email login.
For this I would recommend manual/automated offline backups. I personally use Aegis for my TOTP codes and manually backup the codes. I setup 2FA for a new service only about...