If you live in a third world country, or lets say you don't have a smartphone (a LOT of people still don't), you can't use Google Auth which leads to being forced to check your phone every single time you log in. This is a big no-no.
Reconsider how you run this.
How does it 'literally make no sense'? It literally does make sense because people lose their coins all the time and as soon as they do they bog down support with complaints asking where their coins have gone. And who are these people in the third world that don't have a phone but yet have the internet, computer and are actively involved in the crypto community?