Besides the huge hole here, what I found ugly about their implementation is both how cumbersome it is to set up (can only use one 2FA method) and how cumbersome it is to use. I stopped making payments with Paypal recently because of how annoying it was to finally auth a payment.
will it work if you don't have an ebay account?
He hasn't really found a bug but a usability tradeoff.