On Safari in latest macOS/iOS, it pops up an official prompt for signing into appleid.apple.com instead of having you remember and enter a code[0], so it become

On Safari in latest macOS/iOS, it pops up an official prompt for signing into appleid.apple.com instead of having you remember and enter a code[0], so it becomes "you either need to use the local authentication factor, eg. face ID to sign in, or be in possession of an unlocked device and know the password". The real question here, IMO, is how do you prevent against this. Because to the Apple engineers in the US of A, having your phone stolen at gunpoint is almost unheard of, and getting it swiped from your hand is also barely a problem anymore since thieves in the US typically don't go through all this effort to phish the Apple ID password from you (at most they sell it to a 3p service that ships it overseas to China for teardowns and parts salvaging). 0: https://apple.stackexchange.com/q/382190 https://apple.stackexchange.com/q/382190 (note that it prompts for local user account password because the long-lived token that performs a new grant for the Safari session is stored in local Keychain; so if you have touch ID or watch unlock on your Mac, it'll use that first)