Combination of options results in strange behavior

Problem/Motivation

I configured this module with SMS (Twilio) validation and Recovery codes + Help page fallbacks + Force TFA module for only one role.
Then the customer decided to drop the Recovery code as it considered confusing for it's users.
Result:

• roles with TFA can log in normally.
• roles without TFA are redirected to system/tfa/%user/%hash which is empty (instead of simply logging in)

Steps to reproduce

Remaining tasks

Find out the reason why - create fix.
My assumption is that having no validate plugin (or only Help page) fails a condition to skip TFA.