I can tell you from ten years fixing hacked web sites that WordPress password related hacking is the least serious issue on the board (though it gets a lot of press for some odd reason).

Two-factor authentication is overkill for most, and tends to give clients a false sense of security.

The main reason why client's are hacked has less to do with passwords and more to do with client's not updating their plugins, themes and WordPress installations.

I would go so far as to say that in my professional experience less than 20% of hacking situations are passwords related.

WordPress has already "solved" the password issue IMHO by including the "Strength indicator," and most security plugins have options to force strong passwords. When used they effectively close the username / password "hole" which was in previous years often abused.

In short, if we all focus on educating our clients toward maintaining updates, and less focus on the latest password management meme, there will be a lot fewer hacked websites tomorrow.