Depends on the criticality of your product. I used to work for Duo and testing in production would be a nightmare there. Deploy a bug and doctors are unable to authenticate. That said, the vast majority of products aren't that critical