More than users, too. SMS 2FA for instance will encourage important services like banks and government applications to omit or bypass higher security measures because the visitor is extra verified. When in reality, this is just a boon to attackers, because it's easy to just steal someone's phone number to pass the verification, and then the website's made it even easier by not giving you any additional obstacles. No abuse protection or whatever, because clearly you're the user.

A service I use recently introduced mandatory two-step verification. This is good. However, they implemented this by adding the email factor to all accounts. I had much more secure methods configured, but now you can bypass them with email. This is bad. I'm still not sure they understand what a critical security issue this is.