This was my experience as someone with SMS 2fa disabled, only with app authentication or security key.