It's purely CYA and perceived value - they already had my email and phone number, so they're not getting anything new. "We offer 2 factor authentication so our service must be valuable." Except for the part where they enrolled me without my choice, and I have to opt out... But only after being confirmed through 2-factor identification, of course!