Their state handling for the push notification based MFA factors is _atrocious_. I have had to “re-delete” a long wiped phone (or two) multiple times from more than one account. It seems to have finally stuck in the past year, but I’m suspicious that one day it could bite me in the ass.