There have been some changes in Drupal core 10.1 as to how the CSS aggregation works. I'm not sure exactly what's changed but here's at least one issue tracking it #3370828.
After updated to 10.1 we're seeing that the page to enter the verification code while trying to log in (/email-tfa) is loading unstyled. This was happening in our custom theme, and after switching the default theme to Claro it's still happening. Turning off CSS aggregation causes the page to load properly styled.
Enable the module in a Drupal 10.1 install. Turn on 2FA and have CSS aggregation on. Try logging in and see if the verification page at /email-tfa that you are redirected to from the log in form is styled.
See if turning off CSS aggregation fixes the bug.
Not sure what the fix is here. Maybe it's a case of waiting for the 10.1 bug to be fixed. However I'm not seeing this happening on other Controller pages in other modules so maybe there is a change that can be made in `email_tfa.routing.yml` for a fix. Although if it's working with CSS aggregation off then I don't know what it would be.
Closed: works as designed
1.0
Code
Add the `system.js_asset` and `system.css_asset` routes to the excluded routes. I think the module should do this during installation or programmatically in EmailTfaSubscriber.
I don't think this is works as designed, I think it really does require a patch doing what aws outlined in #2