[lordlimecat]

No, it requires a token which is one factor. Usually (but not always, as in the attack detailed in the article) obtaining that token requires 2fa.

This is behavior that I have seen with no other company.