Is the moral of the story, associate your email with the account when you sign up? Or are you saying that in doing so, you are making it less secure, so don't do it?
If you are dead set on using GreenAddress then definitely associate an email address as well as multiple 2FA devices. But the best path would be to either learn to manage your own mnemonic/private key or use a service that doesn't punish you for being a beginner.
If you still need help retrieving your bitcoin cash, I made an online tool for recovering bitcoin cash from GreenAddress (there still might be some more unclaimed bitcoin cash).
YouTube walkthrough: https://www.youtube.com/watch?v=A8KYvtMhMbI
Recovery tool link: https://bcash.charlesmoyes.com/
Exact thing happened to me. I was a first time user of BTC and realized I would never be able to send it out of there. Youch! Like you have to read every single nook and cranny of the security section before you ever make a move. You're right, they should make the steps in set up a bit different and make you use google auth to log in, or at least make doubly sure you write down a recovery seed for the G2FA, or something.
I lost Over $200k to Traders Vandetta. They made me trade and never allowed me to withdraw. I called them and they never picked up my calls, I sent several mails and they never responded. I reached out to my lawyers and they were unable to do anything from their end. Traders vendetta closed my account. So I reached out to Recovery@blackwebs.org a Binary Options and crypocurrency Recovery Expert , They guided me on steps to take to recover my money. I have been able to recover my money. I will never trade again