I work for a university. It came down as a requirement from above because our most important users are older (rich) donors who struggle with even basic login.