FYI we improved this capability to also allow per-Organization MFA factor selection using extensibility: you can customize the MFA factors that are required for end-users in a variety of different scenarios. See this example which demonstrates how this can be done on a per-Organization basis using Organization metadata.