Holy crap... That's not what frictionless means. That's literally the definition of appropriate levels of security based on risk profile, but even high levels of security should be frictionless, i.e. they should work the same way every time and should be relatively easy to do, which is what 90% of MFA apps are. What's not frictionless is when your security team needlessly causes you to change your very secure password every 90 days because someone told them that was a good idea. It leads to sticky notes and easily cracked passwords that use formulas i.e. Spring2019! Summer2019! And so on like in so many corporations due to poorly thought out security implementation. Longer time before forced password changes coupled with either a physical key or software token that don't have to be remembered are way better.