Possibly, but the insurer cares about GitHub, not its customers. If your account or even a thousand GitHub accounts get popped, the only risk to GitHub is reput

Possibly, but the insurer cares about GitHub, not its customers. If your account or even a thousand GitHub accounts get popped, the only risk to GitHub is reputational. I would guess this has more to do with the SEC's new reporting requirements. They seem to be treating credential stuffing attacks as breaches (which they aren't, at least not exactly) and putting the MFA burden on customers is an excellent way to prevent those.