This is one of the main things I test when doing application security assessments.

I look at the various clients/interfaces and test each of them to see how their controls compare. It's quite often that certain clients or interfaces have far less security on them than others because it simply isn't convenient.

One example would be two-factor on a VPS administration page. It's on the main site, but if you download the mobile app it's password only.

Which means...it's password only (assuming you know how to use a proxy like Burp).

So important to ensure that all interfaces to your app have the same minimum requirements for security.