How can they support 2-factor auth without also having the ability to spend the bitcoin in the wallets? What's needed is a way to keep bitcoin on remote servers without them having the ability to spend it, but to grant access with 2FA. This prevents password phishing attacks and keylogger attacks, without the user having to worry about their harddrive crashing and losing their wallet. But I'm not sure whether that's possible short of making them keep an encrypted wallet, which negates all of the user convenience of using an exchange.