I also just found this statement, which may explain why you are getting asked for a code even when 2FA is turned off. If you click on that 2FA option in the account settings, the next screen will say "We may require a second step if we don't recognize your device, even if 2-step is turned off."
