With the new feature, Two-factor authentication for staff client - TOTP, staff permissions seem to be needed to activate this:

my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
    {
        template_name => 'members/two_factor_auth.tt',
        query         => $cgi,
        type          => 'intranet',
        flagsrequired => { editcatalogue => '*' },
    }
);

which means that only staff with top-level catalogue permissions can activate their two-factor authentication.

However, I believe this should be allowed by all staff accounts which would change this feature to allow staff to have just the "Staff access, allows viewing of catalogue in staff interface (catalogue) " permission.