In their defence, sometimes organisations are stupid where individuals are not. Many people might realise that cloning is an unaccounted for aspect of a 2FA, b

In their defence, sometimes organisations are stupid where individuals are not. Many people might realise that cloning is an unaccounted for aspect of a 2FA, but the manager in charge, say, thinks cloning is not a realistic possibility and so doesn't allow it to be taken into account. Or, the manager does think it needs addressing but they get a bonus if the system is completed earlier and they know it will take longer to address the issue, so they argue it's not a realistic attack ...