Everytime I have to move my mouse to the Submit button, I think about how their UX to nickel and dime microfees from you is super slick.
Their OTP/MFA is still not configurable, as far as I can see. When trying to figure out how to disable passwordless/OTP only log in, I saw someone trying to do the same describing how without the ability to disable OTP login, their kid logs in to their paypal by using the OTP text and they shouldn't have to delete their paypal or work around it with phone settings to have some basic security on their paypal account. It's such poor security because of spoofing attacks anyway, but anyone who knows your email and can see your phone can log in to your paypal by default. I also hate their stupid 'try another way -> sign in with password' flow on their log in. It's my password, not 'trying another way'. Ah, their UX is so bad.