Try putting -vvv when you connect and see what's happening. I can imagine this happening if you have multiple identities (private/public key pairs) on the client and you hit a max retry limit. Pub key is always tried first, and it should ask for password once all the local keys have been tried.
At the cost of sounding naive and stupid, wouldn't it be possible to improve compilers to not spew out unsafe executables? Maybe as a compile time option so people have time to correct the source.
What kind of prompt does your company 2FA provide? Using openconnect with networkmangler, I get a pop up to input my pin+totp. I haven't done the script way in the last few years, but the connection script is plain shell and I was able to handle the 2FA from there too
Let's call it Bigus Dickus