It's a security meassure to make sure, any profile related action (changing email, changing password or even chaning avatar) requires a secondary factor in addition to the current password by default, even if (Google/TOTP) 2FA wasn't explictly configured by the user.

The second factor will be sent to their email, which they then have to enter in Rocket.Chat to confirm the action.