"Although you turned it off already, we still have multi-factor authentication or MFA which allows you to receive the code by email, text, or call."

If that is true then we haven't turned anything off... The end user should be able to set their required security preferences.