Hard disagree here, supply chain attacks are big business, it matters a lot more than a few thousand bucks in a savings account which can be easily reversed if stolen by crooks. PyPi isn't "every single website", it's full of modules powering a lot of the internet and other critical infrastructure.

I have a hardware key for the 2FA on my meagre open source libraries, it takes 10 seconds to pull it out of my pocket and use it. Why is that a bad thing if it's enforced? It seems more like you have a UX problem here, there's solid open source TOTP software that come with browser extensions and are one click to use. SMS only can be a pain but many companies are moving away from that, albeit slowly.