to be fair, by commenting on this very forum, you're already not "the norm" ... the average user can barely keep track of their password!! I'd argue that most users already have some form of 2 factor auth, because they can literally never remember their password, so they (barely) remember their password as the 1st, and then the "change password" email serves as the 2nd.

So yeah, not very good at maintaining data secure for the average person ;)