[r2_pilot]

Nope, the proper lesson is to provide a secret (such as a 2 digit code) with the 2FA request that the authenticator must also present instead of just hitting "approve".