I used to have my retirement accounts at Fidelity. One day I needed some assistance with something I was seeing on their web UI, so I called them up. The support person said (not an exact quote, but the gist), "in order to see what you're seeing, I'm going to need to log in as you. I need your permission in order to do that. Security precautions prevent me from being able to see your password, so I will need to change your password to a temporary password of '123456fidelity' to proceed. Is this ok?"

I was kind of speechless, but I said, no, that's ok, I've decided I don't need help anymore, and shortly thereafter I closed all of my accounts. I've moved to a smaller firm where I've specifically asked for my accounts to be inaccessible from the internet in any way, and I have a financial advisor assigned. If I need something done, I can call him or his assistant. I can't make big financial moves at the click of a button, which suits me just fine.

Vanguard enabled proper 2FA a little while ago. It's SMS-based, which is a pity, but it's better than Schwab's abortion of a system.