When you open most accounts these days they ask for your cellphone number. Why then is two-factor authentication not enabled by default?

IMO people are lazy. If two factor auth is enabled by default, even if it irks them most non IT people would not take the pain to disable it. Same lies true the other way round.