I don't know if this is as designed, but when I associated my google account on my site all it asked was that I typed in the associating accounts username and password, but it didn't ask for any two step verification. Note that this device hadn't been used lately with two step verification in a while so it should've asked because it asked a few minutes later when I went back to my forum.
This is fixed now, thanks. We've actually gone ahead and changed the association process slightly: you can now only associate with an existing account unless you're logged in already. This pushes the login back to the standard process, which means less chance of inadvertently missing out extra login-time checks like this.