okbutnormally

> They are replacing strong authentication (2 factors) with its second factor alone.

Are they? They don't mention anything about replacing 2 factor here.

A typical login is compromised if you know the password or if the email is compromised. This is not increasing the attack surface.