or if different rules are applied to premium/non-premium sandboxes?

It's spotty. If using suite talk I recommend going to token auth and bypassing 2FA.

yeah, i've recommended to our team to use TBA instead. When our first sandbox as upgraded, the 2FA broke some integrations, so we setup TBA for them. When the second sandbox was upgraded, things worked just fine. So wasn't sure if anyone had heard of any 2FA policy change with netsuite in recent weeks

When 2018.2 comes out, you have to switch.