Yes, as I said it's not reasonable from the end users perspective, but having done so, allowing username+password to bypass the 2fa isn't possible. It is dumb,

Yes, as I said it's not reasonable from the end users perspective, but having done so, allowing username+password to bypass the 2fa isn't possible. It is dumb, what they should have done is notified the user that they needed to set up some form of 2/MFA, not choose random value from profile to become one.