Does it not raise the threshold required to poison the supply chain? If so, can you inform me as to why this is not a good enough solution, such that you would

Does it not raise the threshold required to poison the supply chain? If so, can you inform me as to why this is not a good enough solution, such that you would warrant against the inclusion of 2FA as part of the process? Furthermore, since it's an attempt to solve a known and increasing problem, what do you suggest they do to resolve the issue? This seems some pretty open-and-shut low-hanging fruit to me. "At the expense of uploaders." Arguing against TOTP in 2023 just seems so ridiculous to me, especially for people savvy enough to publish a package on PyPI. I just don't get it.