its just a dumb move IMO.. I'd even take just production having to use 2FA and sandbox no 2FA for development