I think that actually supports your point. if the code needs to stay private, then showing it on the timeline highlights why this shouldn’t count as proper 2FA