I just don't get the reticence to implement it - I added 2FA to a customer facing app we produce in less than a week - and most of that time was coming up with a nice/pretty setup workflow to enable it on your account.