Comment by bitmapbrother

>While Bob didn’t have multi-factor authentication enabled, he had also heeded Google’s suggestions to add a backup phone number to bolster security.

Ah, there it is. No two factor turned on.