Some overlap with T401771: Merge password and 2FA management into a single Special:AccountSecurity page when OATHAuth is installed and T402427: Move Special:AccountSecurity into core, have OATHAuth contribute to it.
@Risker's suggestion
I do seriously urge you to bold the entire two-factor authentication line, perhaps putting it under a separate section (with password reset) as "Account security". Account security is, frankly, a much bigger deal than most of the other stuff on that page. The fact that the two settings directly related to account security are separated by two relatively unimportant settings is a significant factor in the blindness to the line
