Updating sensitive settings has always required re-entering your password. Now you can also confirm your identity for those changes with any of your enabled MFA options, such as a passkey or an authenticator app. As before, a confirmation is valid for a short period, so that an unattended browser cannot be used to change your settings.