When anybody mentions getting an email or text from Apple, the first thing I think is, "How do they know it is from Apple?" Not everything is a scam but there are so many scams out there that one needs to first verify it is real. There is no single way to determine that, though generally scams show weaknesses in authenticity such as saying "Dear customer". Apple knows your name. Even then I can say that people know my name and my email address and it may be out there on the dark web somewhere, so you can bet I do a bunch of checking before believing anything "Apple" sends me.
Yes, the loop is silly but I don't work for Apple so I can only just agree with you. I suspect Apple's take on it now is that they won't do anything about helping your reset security questions, they will only help you with two factor. In your case you can't go the normal route for doing that so you will have to do your best to convince Apple in a phone call or a chat session that you are the real owner of the account. That can be tough.
You do not have to have a second Apple device. You simply have to have a telephone number (or preferably a couple of them). The below is based on the section "About trusted phone numbers and trusted devices" in the article Two-factor authentication for Apple Account - Apple Support
To see, add, or change your trusted phone numbers use one of these methods:
● On your iPhone, iPad, or iPod touch: Go to Settings > your name > Sign-In & Security. Tap Two-Factor Authentication, tap Edit (above the list of trusted phone numbers), then enter your device passcode when prompted. Add or remove the number, then tap Done.
● On a Mac computer choose Apple menu > System Settings (or System Preferences), then click your name (or Apple ID). Click Sign-In & Security, then add or remove a trusted phone number.
● Using a web browser:
1) Go to https://account.apple.com and sign in.
2) Follow Account Security options until you find one letting you change trusted numbers,
3) Click "+" to add a new number (you may be required to verify this number).
4) If you wish to remove an old number, click "-" next to the number.
Similar information for the iPhone can be found here --> Use two-factor authentication for your Apple Account on iPhone - Apple Support
If you had set up an Account Recovery Contact ( Set up an account recovery contact - Apple Support ) you can also get a code that way.
In a situation where a non-functioning device with cellular service was the only trusted number, transfer the cellular service to another device so you can receive a verification code on the other device instead.