I have always wondered why TOTP is always the “2nd” factor and not the 1st. The password should be the 2nd factor you opt into if you’re paranoid.

For grandma, include a Login with Facebook button.