It was possible to believe two-step verification was protecting your account when it was not. Choosing which methods you wanted and saving them looked like switching it on, and the page confirmed it with a cheerful “Saved”. It is a separate switch, and until you press it nothing is asked for at sign-in.
Three things caused that and all three are fixed. The list of methods you can choose from was drawn in the same style as the list of methods you have actually set up, so a method you had merely picked looked like one that was working — every method now says Set up or Not set up yet, and the two lists are labelled. Saving your choices now says in as many words that two-step verification is still off, if it is. And if you have a method ready with the switch off, the page leads with exactly that, instead of a line that reads as though you were finished.
The wording when you turn it on was wrong too. It said you would set a method up the next time you signed in — that used to be true and was deliberately removed, because offering to add a second factor at the sign-in screen would let anybody who had your password add one of their own. Methods are set up from the dashboard while you are signed in, and the message says so now.
Nothing about sign-in itself was broken. We checked it end to end: with two-step verification on, signing in asks for the second step, and asks again on a fresh sign-in after signing out. If yours is off, the Security page will now say so clearly.