I think "real" 2fa isn't going to care about what ReCaptcha v3's trust score is, the case for this is "this user has a recaptcha score of 0.2, they don't have any cookies for this site, and [other system] also thinks they are suspicious. Let's require extra email verification and/or ask to answer a security question".