You actually have to buy the unlocked bootloader version of phones directly from Google, not something the vast majority of people could accomplish on their own. It’s a selling feature they provide so they can cut out middlemen at carrier services like Verizon (either that or Verizon locks it themselves, idk). I feel like if they wanted to detect that a device hasn’t been used in months or years before requiring you use it and only it for 2FA, they could.