If you're going to do mandatory 2FA (which I agree with)
WTF.
Why would you agree with such a thing?
Some of us don't run computers infested with spywares.
Most/all banks and brokerage sites I know of do not require 2FA for their users. It is always optional.
Interesting. I think all major banks in the Netherlands require some form of 2FA for internet banking, but they typically provide the device required.
Even though I've not had a problem with malware or other security-matters in a decade or so, I wouldn't want to transact non-trivial amounts of funds without 2FA.