Clojars now supports requiring two-factor auth to be on for a user for that user to be able to deploy a project. The setting is controlled at the group level, and is off by default. See https://github.com/clojars/clojars-web/issues/823#issuecomment-1676044918 and https://github.com/clojars/clojars-web/wiki/About#can-i-require-group-members-to-have-mfa-two-factor-auth-enabled-to-deploy.