Not a bug, more of a PSA.
When you setup 2FA, there is no mandatory verification step in Lemmy 0.18 for now. That means you can log out without setting up 2FA in your app or software correctly. Be careful or you might lock yourself out of your account permanently.