If this is correct then why does user needs to wait for the email notification for 2FA? It still fall on the email notification since it relies heavily on email right.
The users are only required to verify through email to enable the 2FA at first. Which is one kind of security measures. Through the email confirmation, Freebitco team wants to verify whether the 2FA is going to be enabled by the real owner or not. You will be able to withdraw your Bitcoin on any wallet address with the 2FA code only after enabling it, the email confirmations aren't required. So, the withdrawal doesn't rely on email confirmation while the 2FA is activated.