Comment by ifdefdebug

So what about a opt-out at account level? Something in the account settings, like this:

[check] Allow sign-in from javascript disabled browsers. WARNING etc. (usual warnings about security etc.)

Edit: because users who know to use long passwords and 2FA do exist and don't need all that extra security stuff ...