Thanks, Barney.
Actually, when I did the initial setup on the new iMac and created a new Apple ID for the user, 2FA was enabled automatically without any option to choose yes or no. Fortunately I realized that it happened in time to call the user and explain to them about the verification codes they were going to start getting on their phone and that I would need each verification code to complete the installation.
So, technically 2FA may not be required for setup ... provided you already have an Apple ID. But if you create an Apple ID during setup you get 2FA, no choice about it.
Later, when I created two additional user accounts on the same iMac, I went through 2FA h**l setting up each account, with repeated demands for the Apple ID & password, plus the login password for the account ... and most frustrating of all, additional prompts to "enter the password previously used to log in to this iMac" with no indication of what password they were actually looking for. I got locked out twice due to that and after trying all passwords used on the iMac I still can't tell which one was the one it actually accepted. It's working now, but I hope that I don't have to go through that again.