TFA gets automatically disabled for all users.

Can it be that somehow you are overwriting the user data tables? TFA stores the user secret in that table..

Linking Slack thread in case the OP puts more details there without updating this issue:
https://drupal.slack.com/archives/C1BB308HH/p1733234367979989

Unable to reproduce and the reporter has not provided more information.

I will also add on that had this been able to be traced to an actual bug it likely should have been reported as a private security issue.