You can have 2FA on it (eg with a Yubikey in my case), and also most people have their email address as single point of failure in that sense, as most password

You can have 2FA on it (eg with a Yubikey in my case), and also most people have their email address as single point of failure in that sense, as most password resets simply rely on sending a link to the registered email.