I guess other options could be not allowing the users to set their own password but instead generating a password for them. Or just require 2FA for everything,

I guess other options could be not allowing the users to set their own password but instead generating a password for them. Or just require 2FA for everything, but that’s hard to do with a lot of software.