That's moot. It's totally reasonable for the SEC to not regulate account security best practices and still regulate the company implementing those practices making off with your cash. A Ponzi scheme whose website has mandatory 2FA is not somehow better. The SEC was never designed to protect against all kinds of risks.