The lesson learned is that allowing MFA but not making it mandatory poses a security risk. Arguably, that practice can be even worse than not offering MFA at al

The lesson learned is that allowing MFA but not making it mandatory poses a security risk. Arguably, that practice can be even worse than not offering MFA at all if it gives hackers even better control over your account once they get in: they can lock you out even more effectively.