Is the task about sending a one-time notification to the privileged users who don't have an email address right now, or about setting up a system where, whenever a privileged user doesn't have an email address (either because such a user becomes privileged, or because a privileged user removes their email address), they get notified?

The latter is similar to T58028: Show Echo web notification (asking users to consider providing an email) to users who don't have an e-mail address associated with their account.

Not sure if EmailAuth is the right place to do this. (It's an option; could also use Echo or core or GrowthExperiments (T215626: [EPIC] Growth: Emailability ) or a new extension.

from the task description:

There are privileged user accounts who have not configured any email on their account. There is a risk with the new EmailAuth security measures that these important users may become locked out of their account, as the are unable to lookup the email authentication code.

As currently written, this doesn't seem to be a risk, unless I'm misunderstanding something? If a privileged user account doesn't have an email address linked to that account, then IIUC EmailAuth won't trigger at all.

It might be good for privileged users to set an email address for their account, so that e.g. EmailAuth verification could be used in the event of a suspicious-seeming login; but that's different to what's currently written (and seems like it'd be an account security enhancement that's possible as a result of the EmailAuth deployment, rather than mitigation for a new risk introduced by the EmailAuth deployment).