I guess other options could be not allowing the users to set their own password but instead generating a password for them.

Or just require 2FA for everything, but that’s hard to do with a lot of software.