There are various way to implement MFA. Sending TOTP over email is one of them. Of course it's not the most secure. I personally use authenticator app.

Probably the false alarm or spam email. There's been multiple cases of such phishing alerts.

email with password + otp (mfa code) is quite common in case your password is exposed in some data breach.

am I missing something here?

Would you like to try autosend.com ? More than happy to give you a demo! It's built over SES but will give you a lot more insights so that you don't send emails in dark :)

Let me know

You can try @peerlist.bsky.social ✌️

You can try @peerlist.bsky.social ✌️

You can try @peerlist.bsky.social ✌️

Let’s begin! ✌🏼