If I were Facebook I'd require anyone using the Pay feature to turn on two factor authentication.
Yes, they should do that. And I can't think of anything more annoying than needing to receive a text, just so I can log into dumb old Facebook. (I realize there are other "factors" available but that's not really the point.)
Or, they could do it lazily. I.e., only force the 2FA at the time of money send / receive.