[johnny99k]

You underestimate the laziness of the average employee. I've worked at a company that removed 2FA because upper-level management didn't want to have to re-login once/week.

[caseyy]

Yes, it does become complicated when the management are the laziest. The average worker will do what they are asked to for information security.