Why can't online payments use a use two-factor authentication by default?
That's friction that will reduce sales, and online sellers will move to a provider that does not do this. Stripe would go out of business if it made it more difficult to buy things.