I know lots of people that have their 2 factor auth setups on the same computer they are using to login. If you can compromise that computer, there's no additional "2fa" needed.
All it takes is some engineer that needs admin access for their job installing something.
Well, I think it's as simple as you say. Phones have completely taken over the market. The majority of people don't find any value in having another device that's only differentiating factor is that it isn't their phone. (You didn't mention headphone jacks).
It's just like portable GPS devices, electronic organizers (https://www.youtube.com/watch?v=qdeE_kiG5Co), electronic translators/dictionaries, calculators, alarm clocks, ...
I was actually thinking about MQTT after I posted this.
I'm leaning towards just allowing the mqtt server you connect to to be changed, so that you can point it at whatever in the future, and all messages are plain text and documented.
A lot of people won't fully fuel up their 172 so they can bring more weight, either baggage or passengers. I don't think anyone would fly 6.5 hours in one either, but 2+ is normal for non-training flights.
You might also run into some weather you didn't have to plan for and that changes the prevailing winds at the altitude you were previously cruising at or causes you to divert to fly around it.
The problem is the auth is plain text too and you're open to having your credentials stolen.