It's a perfectly reasonable compromise though if you can't force MFA for some reason. There are many sites which do this today. You don't even need to rely on

It's a perfectly reasonable compromise though if you can't force MFA for some reason. There are many sites which do this today. You don't even need to rely on the cookie if you're worried about the ux for cookie clearers. You could also whitelist an IP address (or even a subnet) when they verify the email, and it would have been "good enough" to prevent this particular situation.