Apparently it's possible to create access tokens that bypass 2FA. Might've been this.
replyCorrect, for CI/CD systems that want to push releases.
replyIf GitHub, gitlab, or circleci, trusted publishing is available. No access token whatsoever.
reply