Also, startups have such an advantage now that there is an ecosystem of COTS and SaaS tooling that can help you do a complete integration strategy. It's arguable MFA regulations would advantage startups because they don't have to deal with the complexity of legacy network piecemeal integration.

I planned and did the roll out of Yubikeys at the last place I worked, before there was a dollar in sales, and the lifecycle could be supported with 2 people (minutes at most out of each day for support) and an integration to our HR platform that automated procurement and mailing of keys.