If you switched two-step verification on, signing in did not actually ask for it. Your email address and password alone still got you in, while the Security page said the account was protected. That is the wrong way round for a security setting, and it is fixed.
Two things were behind it. The sign-in was checking whether you had a method set up in a way that did not recognise modern ones, so it skipped the second step. And a passkey was being counted as a second step when it is not one — a passkey signs you in on its own, in place of a password, rather than adding anything on top of it.
Now: two-step verification always asks when it is on, it can only be switched on once you have set up a real second method (an authenticator app, a security key, or this device), and removing your last method switches it off rather than leaving it on and unable to ask. No account was left switched on and unprotected, and passwords, passkeys and emailed sign-in codes were unaffected throughout.
Recovery codes can now be saved. The Security page described them for a long time without ever giving you one. You can now generate a recovery code, copy it or download it, and keep it somewhere safe — it is what gets you back in if you lose the phone holding your authenticator.
The page also stopped jumping to the bottom every time you pressed something, and no longer stops loading if you or a colleague open it a few times in a row.