This post from one of the devs from Pocket Casts also mention that even email is not protected from Apple's 2FA [rustyshelf.org].