Right, but that's not the whole story. Some documents can be permanently offline and still do their job. The list of police informants might be an example. The officer controlling the information writes it down, but he also remembers it. No one else looks at it except, in rare situations like a police corruption investigation, that officer's commander, or an internal investigation unit.

Other documents, will need a whole process of retrieving information, copying it, adding info, sending it, checking it, sharing it with other people. Police officers' own personnel records might be an example. If you only store these on paper, informal access procedures might be developed. For example, the civilian secretary is used to certain people requesting copies of 6 or 7 files at a time, so they don't always keep track of what was asked for. Unofficial copies get made and kept in someone's desk drawer so they don't have to spend a morning going over to the main HQ. And so on.

Now you have the worst of both worlds - lax security, but also no hope of the traceability and fine-grained access control of an electronic system.

My login specifically? Probably a lot less than "admin" "root" or similar common things script kiddies run. But if it is on port 22, the dictionary will probably be attempted.

Bingo. Which is why the second factor in 2 factor authentication is "something you have".

It's also why SMS text messages do not meet the criteria for 2 factor authentication - it's trivial to social engineer phone companies into moving a phone number to a new phone - presumably one you would not have. Authentication apps are a PITA to move to new devices because having a way to move your keys around without some reliance on meatspace defeats the whole goal of "something you have".