AsherBlake

Not stupid at all! Check ProcessWire forums or official docs!

Yes, you can enforce the TfaEmail module for back-end users by modifying the user roles or permissions directly in the backend. You could write a script that updates existing users to require TFA and ensures that it's always enabled for new users. Also, make sure to lock the setting to prevent any user from disabling it.

I also had the same issue, and your trick worked for me. Thank you.