Could be. But it really depends on how their 2 factor authentication works.
If they are only using text messages, key fobs, or phone call backs, that is different than SFORs patent.
If it is out-of-band the same way as SFORs patents, then yes, they will either be paying SFOR or they will be a potential target of a lawsuit at some point.