It's a little excessive to expect those who are 'View Only' to have to use MFA. This needs to be applied only to the license holders who edit documents.