This has some lessons that apply much more broadly than to just airports (e.g. apps that make you jump through hoops and expect you to know what 2fa or SSO mean)

Exactly. That led me to wonder what in my job do I wrongly assume for my users.