Not add 2fa automatically, but instead prompt with options to add it.

This probably doesn't comply with the relevant recommendations, but cutting a user of from their email is worse in my opinion.

I'm sure Google prompted author for years begging to turn the 2FA on, as well as warning that they will enforce it on day X. Author ignored them all.