It is now possible with Yarn to use the one time token. See: yarnpkg/yarn#6555
So it should not be possible to publish this package without 2FA for security reasons.
How to enable this setting: https://docs.npmjs.com/getting-started/requiring-2fa-for-package-publishing-and-modification