Your investigations might be askewed, McAfee has attacked them before due to the dissosiation of his coin from their platform, which in turn makes his userbase be biased against them.
A proper way to do it would be publishing the poll on a unrelated third party and compare the results.
But you did good when activating 2fa, your settings probably weren't set to prompt 2fa at every login, but it now asks for 2fa every time you log in, not sure why not do it from the start but at least they've fixed it