Especially for remote work - any critical or internal infra should be behind a company-operated VPN, with the VPN-access gated by MFA.
It's obviously not foolproof because the more SaaS you add, the more vulnerable you are, especially because security in HN-land is something you only worry about after-the-fact because it's not MVP or quick to market. But asking for more personal info is perhaps the worst possible conclusion you could take from this.
At some point you have to stop asking your users to take responsibility for your own shoddy security.