It's not a bug.
There is a misconception in your question that leads you to believe that this is bug: You write that the 6-digit code is being sent to the device that you're trying to log in from. This is not the case.
The 6-digit codes are not sent to your trusted device (unless you have specifically requested for the 6-digit code to be sent by SMS text message). The 6-digit code is already there, in the sense that it is actually calculated on the device.
The only thing sent to your trusted device is a notification that someone is trying to login and an approximate geographical origin of that request.
Usually you login from a trusted device such as for example logging in on the "Apple Store" app on a trusted iPhone. In this case, the 6-digit code is not requested. It is automatically calculated on the trusted iPhone and sent along with your password to the server for authentication.
The situation you're describing happens if you use a Mac that you have added as a trusted device (the computer itself) - and then try to login to an Apple service via a browser that is not trusted.
A browser, such as for example Google Chrome, does not "know" that your computer is trusted, and does not have access to the data necessary to calculate the 6-digit code itself - the browser itself needs to be trusted for that to happen. Were the browser trusted, you would not see a request for you to enter a 6-digit code, it would be automatically transmitted.
In your case with an untrusted browser, you enter your password and a notification is sent to all your trusted devices. This includes your Mac (on an operating system level - not browser level). You then get a popup with the 6-digit code that is calculated on your device. You can enter this in the browser and optionally choose to trust the browser, so you do not have to do this again.
The reason why this is not a bug is that 2-factor authentication in this case means that the user authenticates by "something you know" and "something you have". In this case the "something you know" is the password and the "something you have" is the special trust-data that makes it possible to calculate the 6-digit code.
The user that is logged on to the Mac in this particular case obviously has both, and as such it is perfectly valid to authenticate them.
Had an attacker tried to login to the web site with your password that they had stolen, they would have been stopped from authenticating because they do not know your 6-digit code.
Had an attacker tried to login to the web site from your own computer having stolen your Apple-ID password - without being logged in as your user on the computer - they would have been stopped from authenticating because they do not know your 6-digit code. It is not sent to the computer, so they cannot just "snoop" it from network traffic.
Had an attacker tried to login to the web site from your own computer having stolen your Apple-ID password - and they're already logged in with your user account on the computer - then this won't stop them. They already have access to the trusted data and they know your password. Even if the notification was not sent to this device, but only to your other devices, it wouldn't have helped anything - the attacker could just generate the 6-digit code themselves on the computer. The good thing though is that you get a warning on your other trusted devices that someone is trying to log in.
To conclude: This is not a bug - it doesn't reduce security. This is how 2FA systems are generally designed.