Wondering if this isn't related to the LastPass breach?

Paypal's 2FA is a bit of a joke. IIRC (this was quite some time ago) when I went to initially setup 2FA SMS was the only option, eventually they added support for authenticators but you can just click get a text instead of the authenticator. Last time I checked there was no way to tell paypal to only accept OTPs from an authenticator.