If the platform touches account access, dashboard control, or strategy actions, two-factor is not optional theater. It is basic defensive hygiene.