I had thought that they would most definitely be thinking of 2 factor authentication.

Couldn't they even achieve this quickly using Twilio to send SMS token codes to users who opt to have 2 factor auth?