I was referring to an internal org with the ability to employ, e.g. DNS white/blacklisting, URL protection, hardware keys, and not sending official links reques

I was referring to an internal org with the ability to employ, e.g. DNS white/blacklisting, URL protection, hardware keys, and not sending official links requesting passwords and TOTP in the first place. As far as customers go, good luck. I'd drop a business that treated me this way without a second thought. The method only works if administered from a position of authority.