Or don’t use their „security“ features. AFAICT everything would have been fine if they used a hardware key as second factor.