What is the value of iCloud.com if 2FA requires your device? It would seem that the point of iCloud.com and its web apps is to provide access to your content on the go, when for whatever reason, you don’t have access to your device itself.

But if logging into the website requires you to first authenticate yourself with the device, then what is the point of the website?

Of course if you have your device handy — then you wouldn’t need the website...

How is this not a glaring oversight by Apple?
The first time you access a 2FA-protected iCloud account on any device you've chosen to use with 2FA, you must provide the correct credentials with that device to assure iCloud that it is indeed the device you've selected to receive 2FA authentication. You are then offered the choice of ignoring future requests for authentication on that device for some duration of time. Every so often, you must re-authenticate with the 2FA credentials to reassert your identity. Does this help?