Will this not just be taken to mean X (as the app maintainer) needs to have the ability to block users it considers to be abusive from the app.

I don’t think this rule is specifying what an individual user of the app must be able to do.

From a user interface perspective, it’s a pretty bad implementation. Really not dissing the devs here, as they have been doing an awesome job and and getting so much done in a short space of time with the massive new user load.

There is a reason that it is common practice to force a user to verify that they have TOTP (2fa) set up correctly by requiring them to enter the current 6 digit number to enable it. Otherwise it’s way too easy for users to lock themselves out.