Allowing account access with 2fa code alone is not 2fa, so I guess this feels like a made-up concern.