So if SMF 2.1 already supports two factor authentication, the problem is no longer "how to implement 2fa by writing a bunch of code", but rather "will you please enable the 2fa feature"?
Is the admin already aware of this? Because if not, someone should contact him and make this a done and dusted matter.
To implement 2FA, or OTP as discussed in this thread, it is not a matter of code, I don't think I have ever said it, it is a matter of installing a simple plugin, but it is not that simple in reality, since what can cause the most problems are the loads on the server. That's why I think (I'm not entirely sure) that the administrator hasn't done it yet.
Admin knows we've talked about this before, the time needed to do it is another question, but I'll tell him to take a look at this thread anyway.