This is because SSO lets you do it today (via keycloak or auth0 or whatever). 2FA here is effectively an optimisation for those not using SSO. Also, cross signing is effectively is a form of 2FA already.