It is silly, as I think that is disabled if you have "Advanced Protection" turned on. Which... is what I thought they now called 2-step. Seems it is 2-step+?
So, yeah, "Advanced Protection" offerings would be good. Looks like I could make my own app that uses open id to connect?