From my experience, OTAC is typically associated with sites that want to prevent automation and scraping. By that I mean I have seen it being used at EACH log in to create extra friction. Interesting this is being used as part of "regular" security.