For TOTP it's as simple as scanning a new QR code.

I agree that rotating 2FA should ring alarm bells as an unusual request. But that requires thinking.