Other methods being poorer doesn't make your method objectively better. You're probably right on low-hanging fruit, all depends on your threat model I suppose.

Don't password managers have 2FA, and alternate phone numbers?