I'm not sure how much detail we can discuss on here, but it seems that email verification can be bypassed in certain conditions.
I'm not an expert, but would an Authenticator app also be bypassed under those conditions?
We may not be allowed to discuss such here, but maybe ZOS can think about it.