Isn't the bigger issue here that you didn't actually have 2FA and your Google account (which receives recovery mails and syncs "2FA" tokens) was the only thing required to access your Coinbase account?