Steps to reproduce the issue

Activate Two Factor Authentication - Google Authenticator, set it to Administrator (Backend) and activate for your user.
Activate Shared Sessions in Global Configuration > System > Session.
Log out everywhere.
Try to log to backend: Asks Secret Key.
Try to log to frontend: Asks nothing and you can log in.
Go to administrator and access the control pane without providing a secret key.

Expected result

You should not access administrator without providing the secret key.

Actual result

You can bypass the secret key.

Additional comments

In my opinion the best solution would be to ask the secret key before qualifying your session to access Administrator then keep the shared session.
Another accepted solution is to disable shared session and inform in the control panel that it doesn't work in this specific scenario.

I am referring to 4.0 RC3 but I suspect J3 has the same issue