Any multifactor authentication adds protection, but a physical token is the best bet when it really counts.
https://www.wired.com/story/hardware-security-key-passwords-passkeys/
https://www.wired.com/story/hardware-security-key-passwords-passkeys/