It's amazing how many of these recommendations are cloud based. If you have a cloud based box with bad security, anyone can get to it.

If you have a box you own on your own premises, you can have crummy security on that box and still be in good shape.

I like belt and suspenders. 2FA and physical security.