Point 2 in particular rings true.
...If you can't filter out your core user base with 2FA (!!!) from bullshit like recaptch then you've got real problems
...If you can't filter out your core user base with 2FA (!!!) from bullshit like recaptch then you've got real problems
That risk is acceptableness to me though