[marcins]

The kind of customer that reuses passwords is probably the kind that won't enable 2FA if it's optional.

[orf]

Sure, but then it's on them rather than you.