This change looks good, but what exactly does it accomplish? I feel like this would be useful if a user was trying to take an action that required MFA, but their account had no MFA factors configured, but is such a thing even possible? Otherwise this feels like a message that we train users to ignore whenever they see it.

Oh, there's more context in D20044, hang on.

Yeah, D20044 is the better version of this.

This is just a hint like "go dig your phone out of your bag before writing your entire memoir into this box". The warnings in D20044 are more substantive/useful.