Email notification is enough for security purposes as what have theymos said as long as your email account is not hacked too, I think 2FA is not needed since there's an email to your email account were you receive if somebody changing your profile info or something your account has stolen. Together with the signed address on this forum is a solid proof to recover account once it is quoted with someone else.

I think there's nothing to change with the account security system settings, besides it is our responsibility to keep our account safe. So, it is impossible to get hack unless if you sell your account and trying to get back and claiming it is getting hacked.