It sounds like his complaint is that Apple doesn't use 2FA when you acknowledge your 2FA device is unavailable (I had trouble following the article). This is ad

It sounds like his complaint is that Apple doesn't use 2FA when you acknowledge your 2FA device is unavailable (I had trouble following the article). This is admittedly bad. All they need is an offline code or something like Google's recovery codes. It's actually somewhat disappointing that so few sites have something like that.