As several people have pointed out, this is technically two-factor auth. But I maintain it’s silly to ask for verification on the same device. I have several other Apple devices this could’ve been sent to. Including the one I’m holding now.