The pattern is this…

1. 2FA is added to code, not well tested, and bugs go on for a long period with no concern to ‘nip them in the bud’ while code experience is fresh

2. The same thing happened with munging of “&” in title of post and code blocks of comments.