I think they are suggesting the abality to reset 2fa for a service if they have access to your email.

Let's say your database contains your email service, and bank account without 2fa. Let's also assume they got acess to your email through a sham site that had you type credentials in and 2fa.

Hacker gets database.

They can login into your email and use the recovery code the bank send to your email for "lost my 2fa". (And delete the mail notifications as they come in, hopefully before you catch on)

A bank (should) have additional steps such as phone number, or a real recovery key you were supposed to write down, but a random online store or entertainment site will probably will just reset the 2fa and the hacker can go from there.

Realsisticlly we should be using at least 3 password database files with different master passwords for better security.

1. Account logins and passwords
2. TOTP
3. Any 2fa recovery keys.

However in practice, that is a pain in the ass and if someome has taken the time to breach your 1 specific database instead of going after easier targets, they probably have all your databases.