It's not that some facebook system accidentally send messages that worries me. It's the fact that a random facebook system had access to a phone number given in the context of setting up 2FA. That tells me that facebook does not internally treat 2FA numbers as private and secure information.

Maybe there exists some kind of fingerprint-protected usb stick?

These guys announced some intentions regarding this subject just last week.

Ah.. the true opposites; scientists vs priests