The only correct response to this is for companies to make it against internal policy for developers to enable 2FA. Which is sad.
Besides the somewhat minimal cost of $20 for a U2F token I don't see any reason people should not have multiple U2F tokens and register them to their accounts.
Why did you try to make this personal by attempting to insult me?
However, I have an open source project with at least a thousand users who could be severely harmed by both compromise of my account (malicious code changes) or loss of my account (having to fork without being able to update the original).
With this change, in order to protect my users I have to go beyond an anti-compromise standard of MFA to an anti-loss standard of MFA (e.g. by buying many physical devices). I also have to be constantly vigilant as if I mess up and break my MFA, lose that piece of paper, have my house burn down, I harm many people.
So, do I choose to disable MFA, and risk my users machines being compromised?
Or do I enable MFA, and risk my mental health?
Or do I just stop supporting this open source project?
[0] “What if this is a work account?“ FAQ header in OP