It’s asking for a secondary email address or phone number. Security questions are insecure and probably the worst reset methode there is. Most users don’t even know what a security key is so it’s pretty pointless to mention it if only like 1% are actually using it and it could cause more confusion than it helps.

Edit: apparently it actually does ask for both. But it’s not even mandatory. Its just a warning