I am totally on board with critical packages offering enhanced security to protect the user. But, I am deeply disturbed about the fact that we've reached this

I am totally on board with critical packages offering enhanced security to protect the user. But, I am deeply disturbed about the fact that we've reached this point where "enhanced_security === 2FA" by default (which I hate with a passion), with no alternatives considered.