By default, we should offer a choice for levels of security. At least a password, with SMS or 2FA. And if the company makes a few bucks, even more options.