Figured multifactor codes were overkill for my email, then someone tried my password from a 2019 breach
Set up the app on my phone about 3 weeks ago and it caught a login attempt from Brazil that same night. What finally sold me was seeing how fast they got in with a password I'd been reusing since college.
Been there. That password reuse thing is what gets most people, they think nobody connects the dots between old breaches. First thing to do is change every account that shares that password, not just the email one. Then go through and turn on the app for the big ones first, email, bank, anything with money or your identity. The code thing feels annoying for like two days and then you stop noticing it.