Only if they're not on the role that requires 2FA (or if they're a SuperAdmin). For those users, their own Profile page shows a Disable 2FA button that, after a confirmation prompt, immediately clears their 2FA secret and recovery codes (logged as a two-factor-disabled event) — no verification code is required to turn it off. If the account IS on the mandatory Admin role and isn't a SuperAdmin, the Disable button doesn't appear at all — instead Profile shows a message that "2FA is mandatory for your account," and it must be reset by a SuperAdmin using Re-arm 2FA.