As a UK citizen, I was furious about that at the time. I can't understand how that's not illegal, for someone in her position.
You say that as if those are the only two options. How about using a sandboxed browser with a password manager that auto-completes the credentials and a Yubikey for 2FA? Of course this is only to make it as "easy" as possible for them, considering they'd be moving up from post-it note passwords. But it wouldn't be ideal either in terms of security.
Write it on a post-it note and put it in your wallet. If you lose your wallet you probably have some work to do anyway to cancel cards. Just change your password first.
No need to write "password123" down
That’s not very secure. Instead, use “password124”.