Friction is good when it serves a security purpose, not for its own sake. Too much of it and users either stop using the thing or find ways around it, which is arguably worse - as you pointed out!

To have LESS friction you need MORE signals, ones that add up to "this action is low risk, proceed" as a cumulative risk score. Kind of like credit card transactions... most transactions go through silently because the issuer scores them on merchant, amount, device and history, and you only get the step-up prompt when the score is off.

"Manual Approval" and "Bypass Everything" are both what you ship when you have no signals.