Based on this documentation:
allowRememberBrowser should default to true (I think), this shows the remember for 30 days checkbox on the New Universal Login. However, this isn’t the behaviour I was seeing. If I don’t explicitly add the option I’m not shown the checkbox which would align with defaulting to false therefore always needing the second factor.
api.multifactor.enable("any", { "allowRememberBrowser": true });
Could be documentation issue or code issue (or my mistake :))