It's a known issue purportedly being worked on. The way it's supposed to work is that trusted devices that haven't been used for a certain amount of time should be automatically removed (per best security practices) and a notification is sent when that's done. At the same time you should also be getting a notification when a trusted device is added.
It was fixed for a while but has reappeared.Visible MFA was late to the party (and is stll weaker than it should be) when it should have been baked in from the beginning. Frequently security changes implemented after the fact fix one thing and break two others. Particularly true when app development is outourced to a third party.
Under the privacy and security section of your account all current trusted devices are identified - in my case some of my older "browser" devices were showing as trusted devices due to different browser footprints as they were updated after I trusted them. Eventually, they were automatically removed and I received a notification as I should have. Check your trusted devices and remove any that aren't recognized.
Since then, I've simply stopped using trusted devices since the MFA process now allows sending the text code to the email of record.
