Organizations have been doing 2FA for VPN connections for over a decade. The janky way to do it way back in the day (when people still had RSA token keychains)

Organizations have been doing 2FA for VPN connections for over a decade. The janky way to do it way back in the day (when people still had RSA token keychains) was to use an authentication server plugin that would require the user to enter their password followed by the token to authenticate at the password prompt. These types of systems are relatively easy to retrofit. I was using a Yubikey with as a second factor on systems that didn't natively support 2FA in a similar manner since the original Yubikey was released. For RDP it's even easier, RDP is easily configured so that logging in and connecting are two different distinct actions, after connecting you are presented with a login page. If that system is tied to a Windows AD domain, you can enforce MFA via numerous different methods, although unfortunately it's not possible to use Windows Hello over RDP currently (meaning no support for passkeys or biometrics as a second factor). I've used systems in the recent past that enforced smartcard control for RDP access. The fact that most organizations /don't/ do this isn't due to any technical limitations, it's mostly due to not prioritizing information security at leadership levels combined with an InfoSec industry culture that centers more around box-checking by midwits who have certifications than designing secure systems from first principles within your technical constraints by actual experts.