With 2FA condition being part of $wgRestrictedGroups, we no longer have a simple way of testing if a user is actually required to have 2FA.
If a condition for a group is more complex than a simple conjunction, we'll need to analyze it to be able to tell if user can disable their 2FA. For example, for the following condition:
[ '|', APCOND_HAS_2FA, APCOND_SOME_OTHER ]
If APCOND_SOME_OTHER is true, the user is not required to have 2FA actually. They should be able to disable it normally. On the other hand, if APCOND_SOME_OTHER was false, then 2FA should be treated as mandatory.