They could phrase it like please use complex passwords + 2fa, though. It's not their fault if people are stupid.