Requiring two step for the ACP just requires that the account has two step enabled. It doesn't force validation on every login, if the device is set as trusted. (Device trusting is a separate cookie from logging in; you can untrust devices in the account section if you want to explicitly test it.)