reported in https://forum.matomo.org/t/problem-with-the-two-factor-authentication-setting/41128

If a user who is unable to set up 2FA accidentally enables Require two-factor authentication for everyone, they are unable to disable it until they set up 2FA.
(or they update the setting in the db:

update matomo_plugin_setting
set setting_value=0
where setting_name = 'twoFactorAuthRequired'

)

I think this setting should only be allowed if at least one superuser has 2FA already set up (or maybe only if the current superuser has 2FA already set up)