The kind of customer that reuses passwords is probably the kind that won't enable 2FA if it's optional.