Yeah, it's kind of mind-boggling. I constantly get "here's your 2FA code" to my email, despite using an ultra-long obfuscated email address -- meaning attackers have found some auth endpoint that doesn't require entering the 2FA email address to have the code sent (normally I have to type out the actual destination address before it will send the code). I do what I can to keep my stuff secure, but man, idunno. Systems are only as secure as the weakest link and thus far that's always been the vendor, not me.