Also reread your post now with this info added. All it sounds like to me is they have a 2FA for security purposes to protect access to your domain.
SO EITHER DO IT and quick holding your breath or move it to another registar that doesn't care about your security more than you do. 🤷