True. Google does a good job here - they support U2F (and other password hardening techniques), and additionally report any access from a new device. You do have to opt in to these measures, but at least they are available.