It was recently suggested on #wikimedia-commons that users without 2FA enabled should automatically have checkuser (And maybe oversight, and eventually maybe admin) rights disabled, and then automatically enabled once they re-enable 2FA.
We should consider looking into this.
See the (private) task T197500 for a list of users this would affect.