Two-factor as a requirement, not an option

Optional two-factor is adopted by the people who were already careful, which is not the population it was introduced for.

// enforced by middleware, for a capability rather than a role
if ($user->can('access-admin') && ! $user->hasTwoFactorEnabled()) {
    return redirect()->route('two-factor.setup');
}

// and the parts that are always missing:
//   recovery codes, shown once, and a way to regenerate
//   a grace period for existing users, with a deadline
//   an admin path to reset it, which is itself audited

The reset path is the security weak point and the support requirement at the same time — somebody will lose their phone, and whoever can reset it can take over an account. Auditing the reset and requiring a second person to approve it is the arrangement that closes the gap without making it unusable.