Depends. Some websites insists on implementing 2FA in a poor way (e.g. installing dodgy custom apps on users' phones), so for accounts that users really care a

Depends. Some websites insists on implementing 2FA in a poor way (e.g. installing dodgy custom apps on users' phones), so for accounts that users really care about, it might be the case that they would avoid these poor implementations to reduce attack surface. (I am sure it doesn't apply to PyPI, but I am just saying both site operators and users need to adopt best practices in terms of 2FA)