Friend suggestions in a workspace draw only on that workspace’s people. A one-channel guest is only offered people from the channels they are in, and apps and deactivated accounts are never suggested.
The step between your password and your authenticator code is now kept where every Kemble server can see it, so the code works whichever server answers it, and it still works only once. Confirming two-step sign-in twice at the same moment keeps the recovery codes you were actually shown.