They require verification to access the more capable models through their API. It's not required for "consumer" usage, which also includes things like the Codex CLI authenticated via oAuth.

Yes it is, they will trigger it over security related questions.