For what it's worth, I'd definitely prefer logins from new devices to require an email confirmation when 2FA is enabled.