The junk calls I ritually get whenever I need to use the app, specifically after about 1 minutes of opening the app while I am reading says otherwise.

Implementing (no opt in) 2FA on sites where that level of security is not really warranted is just a ploy to get data that can be resold in my opinion.