I haven’t seen anything like this that I figure out and think will add a layer of security. I have my iCloud.com email for everything. However, I use an alias instead of the main account. This way, if a webpage is hacked, they get an email but will not get into iCloud.com even with password and hacking 2 factor since is an alias and for Apple you are not able to login with it. I will recommend this to all of you.
This is done on test I have done, please let me know your opinion and thought about this.