[crazygringo]

Which is why you have to manually enable SSH and it warns you that it's a big security risk.

You're entirely right -- the "proper" way is to login with MFA, enable SSH, do your thing, and then re-disable SSH.