Better for them to start with the very simple exercise of "how much of my life will 2FA make inaccessible if I lose only my phone?"