When you set up two-step verification, you register one or more trusted devices. A trusted device is a device you control that can receive 4-digit verification codes using either SMS or Find My iPhone.
It’s a good thing. I like that it’s optional so that people without cell phones can still use iCloud. I’d like to see Apple (and others) give more choices for a second verification step. Maybe email confirmation? At least they let you use SMS in addition to Find my iPhone, and there are ways of routing SMS to email.