Security is its own section in the menu. It was the tenth entry inside Account, which is a billing group — the wrong place to be hunting when you are worried about something.
Every two-step method now has a Set up button. There used to be two lists that looked identical: the methods you had actually set up, and the methods you were choosing between. Only the second had any controls, so a method you had merely picked looked exactly like one that was working. There is one list now, strongest method first, and each row tells you whether it is set up and carries the buttons that apply to it — Set up, Remove, Enable, Disable, and Move up to be asked for it before the others. Anything you have set up counts as enabled unless you disable it.
The page carried a row of seven ticks that told you very little. Four of them could never be anything but a tick, so most of it was a wall of green reporting things you could not act on, and the two rows that mattered were buried in it. What is left is the one sentence those ticks existed to produce, and it says what to do next.
Recent sign-ins are easier to read, passkeys sit with the rest of your sign-in settings rather than in a panel of their own, and the page is about a third shorter.