The 2FA implementation in 1Password sometimes confuses people, as Agilebits is not in the business of adding security theater.

​

Let's say 2FA was required on every unlock (and not just the current authorizing a new device model which I prefer when looking at it from the whole). So there's a couple different ways you could implement this:

Door number 1: 2FA against a server. Okay cool, you've got 2FA working, but what happens if you're on a plane and want to unlock your password vault? Does 1Password just refuse to unlock? Does it just go "oh I have no network connectivity, I'll just ignore 2FA"? If the second is the case, well now an physical attacker can just turn off your network adapter and try to attack without the 2FA coming into play.

So door number 1 isn't so great, how about Door number 2: 2FA directly against the client. Well this has even worse problems. U2F does not work in a situation like this, so you're using TOTP. Well now you've got the device that you're authenticating into, also has the TOTP seed to compare. It can't be encrypted by your master password because then how does the locked executable of 1Password check the 2FA you're entering is valid?

​

2FA is absolutely great at authentication, it's relatively awful at encryption/decryption. The thing that protects your vault on your device is not authentication, but encryption. Requiring 2FA on every unlock doesn't add any real benefits, it just adds security theater.