But doesn’t NSA also by that logic know that you have visited Tails download page and have downloaded the ISO at some point?

I

Thanks for sharing! Strange that it didn’t require a TOTP code to enable the 2FA. Most services verify that the users 2FA mechanism works before enabling it.