Google's 2FA doesn't make sense. The 2FA bugs sometimes tried to log in to a brand new laptop, and it automatically logged me in without any asking for verification.
The user should probably get a hardware wallet if the user has a huge amount of cryptocurrencies worth millions. It's no surprise that scammers and phishers are doing their best to do their absolute best to get hands-on some cryptos. Also, ramp up the 2FA, so there's an extra layer of security and notify you if there's something wrong.