That's not true, you have the ability in settings to see all old sessions and revoke device approvals. It's pretty easy to clear out your old machines.
True, because removal of _all_ existing sessions and tokens should be automatic when 2FA is enabled (you're saying to FB: I only want to be using FB if I've completed 2FA). Under what circumstances would the user want existing sessions to live forever on old devices? (I can answer that : they would want that when they were making their money from advertising "engagement").
