It does 2FA. You have to implement emails yourself, but honestly it’s not that big of a deal (you likely have to do other emails for your app anyway).

It also does a bunch of other auth things, like OIDC.