They want control over the post content (in case it's deleted, edited, etc) and also track your interaction ASAP, so they link it instead of embed.

You will be asked to authenticate if you try to do anything.

Just checked, I am fully logged in in a clean ddg browser session, and can accept friend requests, etc. But I don't have 2fa enabled.

It may be that the link only worked once. Try again after logging out. Does it work?

Clicked it again, it says: The link you clicked may have stopped working or the page has been moved.

Can still log in as often as I want into clean browser sessions. Even when I log out, clean the session, tapping the url logs me in again.

And every time FB sends me an email: "Someone logged in from some location, was it you?"