Not sure why this is not yet implemented, as this is common with most internet basic applications. But please add asap the possibility for users to enable 2FA to protect their account.
Also please send a notification when someone logs in to their account, including IP address / location. This way you should be notified if someone else is using your account.
Username / password is really super insecure! I cannot understand why this is not yet implemented.
Anyhow, hope this can be addressed soon.
I guess this is overkill, but more information can be found on google / wikipedia if you search for 2FA. (link is not allowed I see which is super!)