While an attacker being able to use just a password (and no 2fa) to delete someone else’s account is pretty bad, stealing information from their account may wel

While an attacker being able to use just a password (and no 2fa) to delete someone else’s account is pretty bad, stealing information from their account may well be worse. There is a lot of personal information that I have that I'd rather see destroyed than fall into the wrong hands.