Repeated failures should not be a reason to turn off account login protection; if setup cannot be completed, one should go through the recovery process supported by the service provider, rather than randomly replacing the secret while another authenticator still works.