It makes your MFA-protected account safer from takeover, but also creates a new risk of completely losing access to your account and username forever.

Github has the same policy, and it deterred me from using MFA for a long time, and when I finally did, I added a large number of alternatives, including the not-so-secure SMS.

I think the fear of being temporarily unable to access your account is already a major reason why people don't use MFA. Turning the threat into a permanent loss will make people even more reluctant to do it.

Dealing with some of the backup methods (e.g. off-site copies of backup codes) is tedious, and I wouldn't be willing to do it for less important sites. If I had 2FA on Gitlab, I'd probably turn it off now. (Actually, just saw they don't have an option to add a phone number - I'd definitely turn it off.)

> ... but also creates a new risk of completely losing access to your account and username forever.

I may have misread the announcement, but it sounds like upgrading to a paid account recovers (npi) the ability to recover your account.

How does one upgrade their account if they cannot access it at all?

I suspect if one can a) exhibit genuine interest in becoming a customer waving their credit card around, and b) demonstrate ownership of 1FA for the account, then this would be relatively straightforward.

Or rather, at least as straightforward as the process is meant to be for existing paid-up customers, as per TFA.

Yes. I would cheerfully enable this for almost everything. If your product or service isn't worth several hours of my time to try to recover, then I shouldn't have to risk it being worth several hours of somebody else's time to steal it.

Does it make free accounts safer than paid accounts?

Yes 100% it does make it safer.