In my opinion, new users aren't gaming the system. Instead, they are confused by the multiple login options provided... perhaps they are at a different computer and log in using FB on one, and Google on the other.
I know from personal experience that it's a pain to authorize a new workstation if multifactor and other security controls are set up. Furthermore, SMS validation (Facebook, Google) for those instances where someone must "save a browser" is only possible when cellular coverage is available. For users overseas, it's very possible that SMS isn't as available as urban folk may take for granted.
Finally, many Facebook app developers are required to use multifactor security, as the enhanced "privacy dinosaur" app-checklist forces all developers to configure their accounts for such security.
So, yea, they are new to SO and it's more of a "HRD" (home realm discovery) issue than anything else.