Correct. Perhaps I'm being pedantic but my past experience has been to log in via 2FA, update settings to disable 2FA, then authenticate via 2FA one final time before it is finally turned off. This has held true across many services.