The mfa codes that are visible in notifications with the "Copy #####" feature are exposed on the lock screen, allowing bad actors to access accounts without unlocking the user's personal device.