At the very least, have e-mail 2fa for new devices, it's fairly trivial, isn't too annoying, and works decently enough. Most banks and important services do this. Whenever you login for the first time on a new device or far away IP, it sends you an email to authorize the new device. It's pretty trivial but goes a long way.