2FA at least via Google/MS Authenticator is a must. IG Authenticator is way too cumbersome to login with daily to glance my positions, particularly when the password is masked.
It would be WAY better if it could utilise push notification via mobile device, the way Microsoft Passport works. Clients should feel encouraged in using this without it being an obstacle.