Whether or not it's a pain for businesses to comply has nothing to do with the reason these types of laws are implemented. Regulation is a pain, but that doesn't mean that we shouldn't have it. Protecting personal data is the priority when it comes down to it.

I don't see what that has to do with this. They just need to not implement the feature this way.

Don't put the 2FA number in the search index, just don't do it. By all means make it convenient to copy it there, but for the love of god do not put the 2FA number in the search index.

How is this related to an article that doesn't even mention GDPR?