They might.... might.... let free players add a security key at some later date, but I doubt it. Why would they?
Um, so they can keep their accounts secure? Why else are you applying two-factor authentication to your account?
I would like confirmation that I get to keep using my security key if I lapse to F2P. Anything else is crazy.