Because we can't trust our Operating Systems to do their jobs (they're structurally incapable of doing so), we have to trust every bit of code we run instead. GitHub is where a lot of code that gets executed is exchanged, therefor we have to beef up the security on GitHub. Thus, GitHub requires 2FA