Given the sensitivity of the data in both cases they should have had mandatory 2fa set up. However, the other person is right, there's probably a ton of tech illiterate people using this and they likely saw better security as barriers to entry and making less money.