system notifications are not configurable. If you want these notifications to be configurable, you need to create a new category. Not sure I'd want to allow that though.

$wgNotifyTypeAvailabilityByCategory is only needed if you want to prevent some type of notification (email or web) for a certain category entirely. (Or if you want to enable push notifications, which are a bit of a hack.)

I'm not sure we want to allow disabling email alerts on account security information changes?

It would seem, based on a few of the examples here (web, edits to my user talk page, for example), we can have some always on/not so customisable.

Of course, they don't need to be email confirmed to enable 2FA anyway...