Setting up a new device does require three factors: Username, Password and a 2FA on an existing device. But even with a 4 digit PIN most people didn't have PIN

Setting up a new device does require three factors: Username, Password and a 2FA on an existing device. But even with a 4 digit PIN most people didn't have PINs set up on their devices, so increasing friction will not result in more security. If you want max security now, you can simply turn off TouchID or FaceID and us a very long alpha numeric password.