2FA is actually globally enforced for all internal Mozilla accounts, IIRC---it's just not done over U2F. I'm not sure whether the details are public so I can't elaborate further.