JWBserious question to any techies how the fuck does someone get into ur account despite 2FA, just from u going to a website? thats like scary af. i get "dont click sketchy links" but this is hella spooky.
If you log into a site, the site is given an "access token" that acts as "you". This can be used to make API requets that can change your avatar, change your username, or whatever you desire.
Not sure specifically how steam API works (as I usually only work with Discord or Auth0's implimentation), but this is usually how most OAuth2 apps work, including steam.