Having a "re-enter your password to confirm" step is bog standard for critical actions like that. It would be no serious burden for a legitimate user, and an extra hurdle for a thief.