That's pretty fucky, especially since their 2FA doesn't go through SMS for me (it's a system popup). FWIW, there are (or were) other apps which provided similar functionality without going through Apple's hoops.