In reply to Trevor Nelmes.

The problem with 2FA going into core, is that WordPress is supposed to be a standalone software application. When you start implementing 3rd parties, you're creating more vulnerabilities than you're fixing. Also, like you said, there is already a plugin for it. If 2FA is an important feature for you, use the plugin. WordPress doesn't (and most likely never will) integrate with 3rd party APIs out of the box in core. It just won't happen.