Two things people tend to accidentally save in the cloud because many tend to have automatic photo backup on. Are two things a scammer also needs to access your coinbase account.
For those who who feel they have God status because they have a Physical key(ie. yubi key), your coinbase account can still be recovered without it, then the scammer can authorize their own 2fa method. Then sending a barrage of spam emails to your registered address so you don’t detect notifications a account recovery taking place.
Other digital security safe practices are also needed.