Some in this thread thought otherwise and referred to info from 2017 that said the opposite
They have changed account verification dozens of times. The crux is that since 2012, after
two Wired articles "blowing the lid" on what had been a functional, but not very secure password reset process just for the purposes of clickbait, no one in Apple Support can manually reset your password (or remove account lockouts added later for new device login, etc). They can only feed your answers into the same black box as you, and hope for the best. In 2012 security questions were case sensitive for sure. The case sensitivity has possibly been dropped and reintroduced multiple times.
Like Google, they're caught up on the fact that 2FA absolutism leads to irretrievable lockout for dozens of users every single day - I worked Account Security in 2012 and it was hundred a day in that first rollout, because Apple didn't want to alarm people by telling them to write down their security answers during creation or risk permanent account loss - and both companies are constantly trying to introduce some slack into account verification/recovery with little tweaks that are never published, lest Wired immediately set out to prove they can be gamed by bad actors for clickbait once again. So the labyrinth changes from one year to the next.
It's not about account security. It's about avoiding gotcha Wired articles that scare away future customers with how "easy" it is to hack your Apple ID. Apple ID Account Security was fine before 2012. The only thing missing from the old system, where chat support could reset literally any account just because they were convinced you were you, was a way to seal accounts out of chat reset that were being serially targeted by bad actors who possessed significant identifying information on the owners, i.e. people who had already experienced deep identity theft anyway. Otherwise everyone could make their account as secure or open as they wished.
As chabig noted on page 3, your OP issue seems to be that you were adding an account to syspref that had never been provisioned for iCloud before (just Mobile Me and IMAP), and that triggered some edge-case 2FA verification loop which Apple may not even have intentionally put in place. (Whereas when adding the same account directly to Mail App prefs, it does not trigger iCloud provisioning.)