This is also a huge vulnerability that has been exploited.
https://www.theregister.com/2022/11/03/mfa_fatigue_enterpris...