I think he was saying something along the lines of: If you increase the strength of the authentication on an account, then you increase the expectation (in oth

I think he was saying something along the lines of: If you increase the strength of the authentication on an account, then you increase the expectation (in others) that anyone authenticated to the account was authenticated legitimately. So, for example, if you have weak authentication and illegitimate access is common, then others are accustomed to distrusting the service and will react accordingly (for instance, by discounting weird behavior as the result of a hack). However, if you have strong authentication (via 2FA) and illegitimate access is uncommon, then people are accustomed to trusting the service, so they will be less likely to correctly discount and distrust weird things posted by illegitimate actors. Basically, I think he was saying that for something low-value like Facebook, 2FA is a bad bargain because it trades a stronger social mitigation for a weaker technical one.