Look, I only turn on 2FA for my bank account since that's where actual money sits. For stuff like social media, a hack would just be annoying, not life ruining. Email is in the middle, but I usually skip the extra step there too. It feels like more hassle than it's worth for most accounts.