Last weekend, amid a rainy day and my internal debate over vacuuming, I spotted an email titled "Enable Facebook Protect."
It warned that my account required advanced protection from Facebook Protect, or it would be locked after a deadline. A prominent blue "Enable Facebook Protect" button urged immediate action.

I pegged it as phishing at first—until research proved otherwise.
Facebook is proactively enhancing security for public figures (defined quite broadly). I and several colleagues at my publication received these, despite modest followings. Emails from security@fb.com are legitimate.
To avoid clicking suspicious buttons, activate manually:
Follow the prompts. With a strong password and 2FA already enabled, you'll just get a confirmation you're set.
Didn't get the email? Enable 2FA anyway via Security and Login (desktop) or Password and Security (mobile)—essential for all users.