Why not let the administrator decide?

Why not let the administrator decide?

I'm exaggerating for sake of emphasis. Yes, for critical applications we can probably create and memorize passwords that are sufficiently difficult for a machine to crack that they are secure in practice, but that still depends on everyone who uses the system being willing and able to make and memorize that kind of password. One of the lessons we should have learned from password expiration is that making the system harder just gives people an incentive to try to cheat, undermining the supposed benefits. If passwords are too hard to create and memorize, and people will cheat the system by repeating the same word 6 times or something similar.

Another important point is that depending on a harder password still leaves that password as a single point of failure. It's still vulnerable to phishing, mistakes that leave it unencrypted somewhere, and all the other non-cracking ways we've seen passwords fail over the years. 2FA gives you some redundancy against those kinds of failure.