This is a known TODO, but making it more formal, potentially as a tracking bug... But 2FA should be available (not enforced, yet anyway) for all users, and then we should be looking to enforce it for users with certain elevated groups

Whether sysop is necessarily high enough is a question for the community... For other stuff like Stewards, Staff, Sysop, CheckUser etc, this should become part of policy