these sorts of fake 2FAs are only marginally better than no 2FA, most of the time someone compromises a delta dot com password they probably already have the email compromised as well (probably because the user has the same password on both)