Absolutely sure, and verified yet again after reading your reply.
Also using TSSOP20 package here, with the HSI oscillator, and not using the SPL/HAL, nor even the default start-up code (I changed it not to call HAL's SystemInit() and to disable PFIC HPE).
I can't 100% state that the reset value in AFIO_PCFR1 is actually zero for me - I could probably look with a debugger - but whatever it is, I never change it (nothing in my code touches AFIO_PCFR1) and the PA1 & PA2 pins act as GPIOs for me (both are used as inputs). There is one difference in your initialisation to mine, but it would be weird if that made a difference - where I enable the peripheral clocks in RCC->APB2PCENR, I enable AFIOEN in addition to the necessary GPIO ports.
Maybe, and this is just speculation, there could be a bug where if you don't enable the AFIO peripheral clock, it doesn't initialise the default value of AFIO_PCFR1 properly?
Or, perhaps this was a hardware bug in an initial revision of the chips? What are the markings on your chips? Mine are marked '412309C51'.