Two-step verification question - this seems wrong

Company I work for has a two step verification for the public logins. After putting in user name/password, you're prompted to have the two-step verification to emailed with an obfuscated email shown on screen.

Clicking View Source, though, reveals the Un-obfuscated email in the clear. Giving potential phishers who've acquired user names and passwords a 3rd piece of info, useable for all kinds of social engineering or email account hacking.

This IS unnecessary and against MFA best practices.... right? Or …

clear clicking cybersecurity email logins name names obfuscated password public question screen two-step verification verification work wrong