Everyone I know who works in security has seen Some Stuff. But I've never seen a website that told users you must remove two-factor authentication.