I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice. Asking users to print

I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice. Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too. This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.