Why is every staff member suddenly asked to set up two-factor when they log in?

That is how the Admin panel switch works. While it is on, anyone who logs in without a second step already set up must add one before they get in. The screen says Set up two-factor and offers two choices:

• Authenticator app: scan the QR code, enter the 6-digit code and click Confirm & continue.
• Email code: Wcart emails a 6-digit code to enter.

After setup, each person saves their backup codes and clicks Continue. This only happens once. After that, they just enter a code at each login.

The Storefront (customers) switch works the same way for shoppers. If you don't want this yet, turn the channel off in Plugins → Two-Factor Authentication.