Apparently it's possible to create access tokens that bypass 2FA. Might've been this.

Correct, for CI/CD systems that want to push releases.

	▲	masklinn 15 hours ago \| parent [-]
		If GitHub, gitlab, or circleci, trusted publishing is available. No access token whatsoever.