If they want to go through enough effort to unlock it, fine. But at least I'll have a chance of resetting authentication before they get to it.
https://twofactorauth.org/#investing
Also, non-SMS 2FA on your email helps secure anything that uses emailed password recovery. Same if you use a hosted password manager.
If they want to go through enough effort to unlock it, fine. But at least I'll have a chance of resetting authentication before they get to it.