2FA is 3rd party permission. Its a broader attack surface. It removes power from the user. Its a prequisite to every "why come you don't have a tatoo?".