So you are ok with 2FA, right? If you contribute code there.

Now - what if you are not ok with it? What can you do?

> Almost offensively usable

I think you conflate two points here. One is how useable github is. The other is: control. At which point are you no longer ok with what a private company does? This is not solely about Microsoft alone by the way.