Has anyone in the EU tech policy space considered just making it illegal for services to charge more for MFA, SSO, audit log streaming, and break-glass/split privilege accounts?

If y'all are serious about improving SME security, that's an easy win.