It certainly could've been done by design but I think more likely this was a doomed project from the start. They rushed this app out with too little time for te

It certainly could've been done by design but I think more likely this was a doomed project from the start. They rushed this app out with too little time for testing. I don't want to speculate too much on that screenshot but it looks like they have an error in their Auth0 integration. When you use a service like Auth0 you give it a redirect url to send authenticated users to. It looks like they passed in an invalid url for that redirect. Maybe they only tested this 2fa step locally and something was different when they deployed to users' phones, I can't say for sure, but it doesn't look good.