In the current version this restriction is tied to one specific staff-account type on the business, rather than every staff/admin login generically — regular retail customers are never forced into it, and neither are super-admin accounts or accounts still going through onboarding. If it applies to your login, you'll see a mandatory pop-up on every page (except while you're on the 2FA setup pages themselves) prompting you to Activate two-factor authentication, and the Disable 2FA button on your profile is replaced with a notice that "2FA is mandatory for your account."