counter-anecdote: I've had zero issues with FB 2FA and I'm pretty sure many, if not all (I would hope it's an internal policy, but idk...) FB employees have it

counter-anecdote: I've had zero issues with FB 2FA and I'm pretty sure many, if not all (I would hope it's an internal policy, but idk...) FB employees have it enabled, so it'd be pretty difficult for them to not notice serious issues with the use of their implementation (as your post suggests exist).