They're just forcing 2FA on accounts that meet some kind of threshold of "suspicious" behaviour. There's likely a lot of metrics being used to identify that.

Facebook does prompt people to upload Photo IDs sometimes but I doubt Netflix wants to get that invasive.

(I had interpreted the question as related to how to interpret the T&C. Agree that ultimately, it’s impossible to enforce the existing T&Cs to the exact letter, although some combination of annoyances and mild shamings might affect user behavior and presumably this is what they are testing.)