I have email two-step enabled on my account but it just let me log in on my new phone without sending me an email (even let me turn it off 2step email only required password) does the same with authenticator codes as well (just tested)
I was out of the office today but I'm in Tuesday so I'll try to have a look at this. It may be due to the phone being on the same IP address.