Your actions may make it some If these things happen as well. I can think of a few organizations where your script would have resulted in your account being locked down and a security incident.
Just about every business will have options that are a perfectly reasonable choice in some circumstances and really, really stupid in others.
Microsoft has billions of users. The security needs of the US Department of Justice are not the same as my mom’s real estate office.
When you use 3rd party IdP, for example, how does Azure MFA know what the app is?
The configuration described was not out of the can. Somebody decided to make it the way it was.
Most likely due to some physical (not legal) issue that would make it mechanically unsafe to operate the vehicle above that speed even in an otherwise appropriate location. (Or perhaps it's due to some obscure state law, or the manufacturer is just out to spoil your fun, or ... who knows?)
More generally, I agree with the point you make here about the responsibility to configure things correctly. However, it seems to me that Microsoft is also on the hook for failing to include the necessary context when an MFA request is sent. It's a bit like selling a car with seat belts that superficially appear to work but fail at the slightest provocation, no?
That said, I'm sure there's a reasonable level somewhere in the middle. The current situation certainly doesn't sound like it, although I haven't used any form of Microsoft MFA, so I can't really say either way.
It is is on by default however when using the same mobile app for Hotmail or XBox live accounts.
Microsoft thinks the data of Fortune 500 companies is less valuable than your Minecraft skins.