Or more primitively than that, I've seen small offices have an old shared phone with a bulging battery that's used for 2fa (or even just having it attached to someone's personal phone and just asking them for the code when you need to log in).