I wonder if they're not doing what my bank claimed it was doing when I raised that I didn't get a 2fa challenge on their new website: they claimed that they had some ai integration to skip 2fa when it "wasn't necessary", I think they were trying to simplify user flow. However, I'll say now what I said to them then: this just reduces my confidence in the security of the site. Last time I went to the site, I was prompted, so I don't know if they took the comment onboard, or I just "got lucky".