you need 2fa to log in and withdraw coins but not to release from escrow. that is the prerogative 0f the seller/buyer.
Yes, you do need 2FA to release from escrow. At least on my account you need that. I just checked and there was no option to choose when 2FA will be used.