Security is about risk management. If the value of what you’re protecting is low, or the consequences of not accessing something is high, than the MFA control may not add value.

The problem is in general people are really bad at assessing risk. You tend to see extremes.