How do I see who has not set up a second step?

Users → All Users has a Second step column, and the No second step link above the list narrows it to the people who can change the site and have not set one up. The link is there whether or not you require a second step, and goes away once all of them have one. Settings → A second step gives the count, and wp login-security two-factor list --missing prints the same people from a terminal.

Nobody can set one up for somebody else, so the next step is to ask them. If a second step is required of them, they are sent to their profile to do it the next time they open the admin, or on a shop, a customer to My Account → Two-step sign-in.