> People who use 2fa are not related to the same group who updates their dependencies This does raise the question though - should they be related? If so, why?

> People who use 2fa are not related to the same group who updates their dependencies This does raise the question though - should they be related? If so, why? If not, why not? From TFA, it seems github believes that a positive correlation there is worth pursuing and they offer reasons, though I have no idea how their corporate-blog-speak relates to their actual motives here.