That rather depends on your usage pattern, I expect. Twitter has similar inconsistent reports, and I can confirm personally that I was suddenly asked for one as soon as I tried to post anything; I believe I also had something like that happen with Discord, but I don't remember as clearly.

Not that it's necessarily malicious in intent—requiring “extra verification” only on suspected misuse isn't entirely unreasonable, and that's awfully hard to distinguish from things like targeted privacy attacks—but it would be nice to establish this sort of thing as common knowledge, especially since I imagine the chaff of “huh? no they don't” is only to their benefit.