They’ve been complacent for too long on polishing up the non-Windows and mobile clients. Their recent push to use the mobile app as an authenticator and the bugs surrounding that is a good example. I’m not at all surprised an issue like this has happened.