Am I missing something or is this just a run-of-the-mill phishing attack? If it is, then every website under the sun that doesn't use a FIDO or WebAuthn is susceptible to it. How is this any different?

In fact, Google has a very similar 2FA option where you can simply press a Yes/No on a mobile device you are already signed into, in order to authenticate another device. None of the this PIN stuff is going to do much to reduce the odds of phishing.