yeah. What the table needs is a column of how to mitigate each risk. Besides MFA, there's also all the things that the very first para says aren't important,

yeah. What the table needs is a column of how to mitigate each risk. Besides MFA, there's also all the things that the very first para says aren't important, e.g. avoiding password reuse (HIBP is now a Microsoft thing)