MFA is required as passwords are no longer sufficient, by themselves, to ensure accounts remain secure.  Unfortunately, account breaches due to compromised credentials are becoming more common.
With an increasing number of passwords to remember, people are prone to re-use the same passwords for many accounts or use weak passwords, which can easily be guessed. When other non-University services (social networks, websites, etc.) have breaches, these, in turn, can lead to your credentials being compromised and used to access University information.
Even with strong passwords, attackers continue to launch targeted phishing attacks designed to steal passwords regardless of length and strength.
Passwords, when partnered with MFA, provide much stronger protection to your accounts. Password + Proof = Secure Access.