It's a funny frame device to float a couple different satirical ideas. I'm sure faculty members – and most people – understand that 2FA is a necessary minor annoyance.
Requiring signing into my Microsoft account (with two step authentication code) every twenty four hours on a company laptop you control is obnoxious. You should educate and empower your employees, not treat them as the weak link in your armor.
The yearly security training is probably just a compliance checkbox companies do. If they wanted an educated workforce that practices security first there are other far more effective approaches.
Of course, that all ignores the fact that employees are weak links not because they are dumb, but because they don't have an incentive to protect the company when they or their families are put in danger by a threat actor.