"Require 2FA for everybody, full stop" would do the trick.
The proposed solutions you outline all assume that "password + security question" is only an insecure system for celebrities. But we have enough experience by now to know it's an insecure system for everyone.