"DEAR" EA, TURN ON 2 Factor Authentication BY DEFAULT

I think they can’t because of the same reasons they have to get you to check boxes to receive notifications. Sending a client messages they did not sign up for is a violation of law, at least in the United States, but I’d expect that’s also the case in other countries.

Edit: reason for US falls under the CAN-SPAM act, in which no business may send unsolicited emails or other digital messages. Thus, TFA has to be opt-in, since it uses such means to convey the details.