(1) Is it really that hard to implement 2FA, and (2) Did you just implement the same insecure SMS nonsense that's been getting people's accounts compromised for a while now?, and (3) Did you bother putting anything in your UI saying "Hey! Over here! Look at this new feature!"