> The default sign in flow with the app enabled is email + authenticator. No password required

Isn't this only if browser have some cookie from previous session or IP didn't change?

Edit: just tried (new IP + private window firefox), you are right, I can enter email and select app notification.