Reminds me of how PayPal implemented 2FA, then someone immediately found a bypass since they only made 2FA a requirement for a particular web login page instead of EVERY login entry-point (ie mobile or APIs). PayPal's security continues to be embarrassingly bad.
Not only that - I recently spent about one week of constant back-and-forth with their developer support, because I couldn't pay with Paypal on certain sites.
Turns out their digital goods checkout is broken for accounts that have 2fa enabled. Their response was "WONTFIX, disable 2FA".
Have you seen their web interface or their APIs? It hasn't evolved at all in 10 years. It's the same convoluted, bloated, and slow web experience as it was in 2005. Just because a few smart people work there doesn't mean the project is outputting quality software.
Countless software companies have been able to take aging and massive codebases and evolve them to more modern usable states. Most of the time these big companies such as Microsoft or Oracle still output bad software but at least they show signs of evolution and investment. From an outsiders perspective Paypal is particularly bad at this, their software quality and UX has been in a perpetual stasis while Stripe and others eat their lunch. And that's not simply because of their famously bad customer service.
I'm not a PayPal fan - but at least on my account, the UX has changed significantly since 2005 (especially last year or something), and I could find everything I need for my accounting easily.
The general consumer interface is great now. The business interface, however, is not. It's still the same slow UI from 2005. Actually, it feels like they are still running on servers from 2005. Simple (email, date range, etc...) searches take FOREVER.
The interesting thing is there was a time when PayPal was successful partially due to their excellent security. The story that some ex-PayPal people who are at Palantir tell is that PayPal was very successful in blocking fraudulent transactions where other early online payment players were not. This allowed them to keep their margins higher (not losing to fraud) and spend their money on improving the product.
I have no inside information here, this was told to me by Palantir people when interviewing there.
That sounds like an engineering culture that doesn't let their engineers do things properly. 'It takes too much time and political clout to properly secure our infrastructure, let just do it on one chokepoint!'