Your access to your email account is your password (magic link-esq). Agreed that 2FA is desirable (not sure if it's on their roadmap, will have to ping them and ask). If 2FA is a hard requirement, building your own solution on top of Twilio is preferable (as they require 2FA).