@Ted Clayton says
The exploits against login processes are mainly a matter of walking through the mall parking lot, glancing into vehicles for folks’ keys hanging in the ignition.
Yes of course this is often the case but in many ways these are exactly the sort of people that multi factor protection should help the most. How many people use very simple, easily guessed passwords and then use them on multiple websites. Of course these same people may never do anything different or put any additional protection in place, unless it is forced on them rather than being an opt in as it is on a few sites now. We could of course just tell them to not bother with any sort of password, in fact let's not even bother with any login protection to admin functionality at all.

Are you able to say without question that every single password you have ever used on every website is a "strong" password and is unique on every single website ? Even if this is the case (Can anyone ever say this ?) then if you read the recent research and results of hacking conferences, it is clear that even complex sentence type passwords can and are being cracked.

an across-the-board abandonment of traditional password & username hardly seems an “imperative”. It doesn’t even sound very smart.
How is it not smart ? Any additional login protection has got to be a good thing. In addition to single website logins being easily cracked due to simple passwords, what about the multitude of hacks into huge websites where millions of user passwords have been publically posted along with associated email addresses and usernames - these same login details are then used to try and hack into a multitude of other websites.
A security measure used “on a couple” Internet sites enjoys what is known as “Security Through Obscurity”. The bad guys are not aware of it (and it’s too uncommon if they are), and thus are not putting any effort into subverting it. With success, and widespread deployment, comes the more-realistic test
This plugin is new and we said "we" had used it on a few websites but there have been plenty of other installations but of course it hasnt yet been extensively tested. Of course the more it is used, the more it is targeted, that is the whole history of Windows and one that Android devices are now discovering. Are you advocating not doing anything different because it is new !
If the multi-factorial aspect was the answer, Microsoft and Internet Explorer would have been bullet-proof, all along.
Many large organisations are now introducing two factor authentication but regardless of this, IE security has little to do with this, so unclear what your point is here.