Answer
In practice, MFA on IBM i usually wraps the login path, remote access path, privileged action, or web application rather than rewriting the underlying business application itself. Buyers should ask which access methods are covered first ... green-screen sessions, VPN, web portals, privileged commands, password resets, and emergency access.
The important evaluation point is whether MFA fits daily admin and user workflow without creating bypass habits. If users immediately fall back to shared IDs, generic exceptions, or unmanaged service accounts, the project added friction without adding much protection.