For completion, I decided to make device to device connections an opt-in feature that requires 2fa enabled to log into the account. AUP was also rephrased to make a clear distinction between prevention and identification.